feat(workspace): add Maven multi-module workspace discovery

Add `discoverMavenModules()` to discover all pom.xml manifest paths in
Maven multi-module projects. Uses `mvn help:evaluate -Dexpression=project.modules`
to list declared modules, with recursive traversal for nested aggregators.

Supports Maven wrapper (mvnw) via `TRUSTIFY_DA_PREFER_MVNW` preference,
reusing the same traversal pattern as provider-level wrapper detection.

Adds Maven detection (`pom.xml` presence) to `detectWorkspaceManifests()`
between Cargo and JavaScript in the ecosystem detection order. Also adds
`**/target/**` to the default workspace discovery ignore patterns.

Implements TC-4259

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

Author: Strum355

src/index.js

@@ -8,6 +8,7 @@ import fs from 'node:fs'
 import { getCustom } from "./tools.js";
 import { resolveBatchMetadata, resolveContinueOnError } from './batch_opts.js'
 import {
+	discoverMavenModules,
 	discoverWorkspaceCrates,
 	discoverWorkspacePackages,
 	filterManifestPathsByDiscoveryIgnore,
@@ -23,6 +24,7 @@ export { getProjectLicense, findLicenseFilePath, identifyLicense, getLicenseDeta
 
 export default { componentAnalysis, stackAnalysis, stackAnalysisBatch, imageAnalysis, validateToken, generateSbom }
 export {
+	discoverMavenModules,
 	discoverWorkspacePackages,
 	discoverWorkspaceCrates,
 	validatePackageJson,
@@ -319,18 +321,26 @@ async function generateOneSbom(manifestPath, workspaceOpts) {
  *
  * @param {string} root - Resolved workspace root
  * @param {Options} opts
- * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'unknown', manifestPaths: string[] }>}
+ * @returns {Promise<{ ecosystem: 'javascript' | 'cargo' | 'maven' | 'unknown', manifestPaths: string[] }>}
  * @private
  */
 async function detectWorkspaceManifests(root, opts) {
 	const cargoToml = path.join(root, 'Cargo.toml')
 	const cargoLock = path.join(root, 'Cargo.lock')
 	const packageJson = path.join(root, 'package.json')
+	const pomXml = path.join(root, 'pom.xml')
 
 	if (fs.existsSync(cargoToml) && fs.existsSync(cargoLock)) {
 		return { ecosystem: 'cargo', manifestPaths: await discoverWorkspaceCrates(root, opts) }
 	}
 
+	if (fs.existsSync(pomXml)) {
+		const manifestPaths = await discoverMavenModules(root, opts)
+		if (manifestPaths.length > 0) {
+			return { ecosystem: 'maven', manifestPaths }
+		}
+	}
+
 	const hasJsLock = fs.existsSync(path.join(root, 'pnpm-lock.yaml'))
 		|| fs.existsSync(path.join(root, 'yarn.lock'))
 		|| fs.existsSync(path.join(root, 'package-lock.json'))

src/workspace.js

@@ -5,12 +5,13 @@ import fg from 'fast-glob'
 import { load as yamlLoad } from 'js-yaml'
 import micromatch from 'micromatch'
 
-import { getCustom, getCustomPath, invokeCommand } from './tools.js'
+import { getCustom, getCustomPath, getGitRootDir, getWrapperPreference, invokeCommand } from './tools.js'
 
 /** Default paths skipped during JS workspace discovery (merged with user patterns). */
 const DEFAULT_WORKSPACE_DISCOVERY_IGNORE = [
 	'**/node_modules/**',
 	'**/.git/**',
+	'**/target/**',
 ]
 
 /**
@@ -224,6 +225,157 @@ async function discoverFromPackageJsonWorkspaces(root, packageJsonPath, globOpts
 	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
 }
 
+/**
+ * Resolve the Maven binary, respecting wrapper preference.
+ *
+ * When `TRUSTIFY_DA_PREFER_MVNW` is truthy, traverses from `startDir` up to the
+ * git root (or filesystem root) looking for an executable `mvnw` wrapper.
+ * Falls back to the global `mvn` binary (or `TRUSTIFY_DA_MVN_PATH`).
+ *
+ * @param {string} startDir - Directory from which to start the wrapper search
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {string} Path to the Maven binary
+ */
+function resolveMavenBinary(startDir, opts = {}) {
+	const localWrapper = 'mvnw' + (process.platform === 'win32' ? '.cmd' : '')
+	const useWrapper = getWrapperPreference('mvn', opts)
+	if (useWrapper) {
+		const wrapper = traverseForWrapper(startDir, localWrapper)
+		if (wrapper !== undefined) {
+			return wrapper
+		}
+	}
+	return getCustomPath('mvn', opts)
+}
+
+/**
+ * Walk up from `startDir` to `repoRoot` looking for an executable wrapper script.
+ *
+ * @param {string} startDir - Absolute directory to start from
+ * @param {string} wrapperName - Wrapper filename (e.g. `mvnw`)
+ * @param {string} [repoRoot] - Stop boundary (defaults to git root or filesystem root)
+ * @returns {string | undefined}
+ */
+function traverseForWrapper(startDir, wrapperName, repoRoot = undefined) {
+	const currentDir = path.resolve(startDir)
+	repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(currentDir).root
+	const wrapperPath = path.join(currentDir, wrapperName)
+
+	try {
+		fs.accessSync(wrapperPath, fs.constants.X_OK)
+		return wrapperPath
+	} catch (err) {
+		if (err.code === 'ENOENT') {
+			const rootDir = path.parse(currentDir).root
+			if (currentDir === repoRoot || currentDir === rootDir) {
+				return undefined
+			}
+			const parentDir = path.dirname(currentDir)
+			if (parentDir === currentDir || parentDir === rootDir) {
+				return undefined
+			}
+			return traverseForWrapper(parentDir, wrapperName, repoRoot)
+		}
+		throw new Error(`failure searching for ${wrapperName}`, { cause: err })
+	}
+}
+
+/**
+ * Discover all pom.xml manifest paths in a Maven multi-module project.
+ * Uses `mvn help:evaluate` to read `project.modules`, then recurses into
+ * nested aggregator modules.
+ *
+ * @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain pom.xml)
+ * @param {import('./index.js').Options} [opts={}]
+ * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
+ */
+export async function discoverMavenModules(workspaceRoot, opts = {}) {
+	const root = path.resolve(workspaceRoot)
+	const rootPom = path.join(root, 'pom.xml')
+
+	if (!fs.existsSync(rootPom)) {
+		return []
+	}
+
+	const mvnBin = resolveMavenBinary(root, opts)
+	const visited = new Set()
+	const manifestPaths = [rootPom]
+
+	collectMavenModules(root, mvnBin, visited, manifestPaths)
+
+	const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts)
+	return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns)
+}
+
+/**
+ * Recursively collect Maven module pom.xml paths starting from a given directory.
+ *
+ * @param {string} dir - Absolute path to directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @param {Set<string>} visited - Already-visited directories (cycle guard)
+ * @param {string[]} manifestPaths - Accumulator for discovered pom.xml paths
+ */
+function collectMavenModules(dir, mvnBin, visited, manifestPaths) {
+	const resolvedDir = path.resolve(dir)
+	if (visited.has(resolvedDir)) {
+		return
+	}
+	visited.add(resolvedDir)
+
+	const modules = listMavenModules(resolvedDir, mvnBin)
+	for (const mod of modules) {
+		const moduleDir = path.resolve(resolvedDir, mod)
+		const modulePom = path.join(moduleDir, 'pom.xml')
+		if (fs.existsSync(modulePom)) {
+			manifestPaths.push(modulePom)
+			collectMavenModules(moduleDir, mvnBin, visited, manifestPaths)
+		}
+	}
+}
+
+/**
+ * Invoke `mvn help:evaluate` to list the `<modules>` declared in a pom.xml.
+ *
+ * @param {string} dir - Directory containing pom.xml
+ * @param {string} mvnBin - Maven binary path
+ * @returns {string[]} Module directory names (relative to `dir`)
+ */
+function listMavenModules(dir, mvnBin) {
+	let output
+	try {
+		output = invokeCommand(mvnBin, [
+			'help:evaluate',
+			'-Dexpression=project.modules',
+			'-q',
+			'-DforceStdout',
+			'-f', path.join(dir, 'pom.xml'),
+			'--batch-mode',
+		], { cwd: dir })
+	} catch {
+		return []
+	}
+
+	const raw = output.toString().trim()
+	if (!raw || raw === 'null') {
+		return []
+	}
+	return parseMavenModuleList(raw)
+}
+
+/**
+ * Parse the `[module-a, module-b]` output from `mvn help:evaluate -Dexpression=project.modules`.
+ *
+ * @param {string} raw - Raw stdout from mvn (e.g. `[module-a, module-b]`)
+ * @returns {string[]}
+ */
+function parseMavenModuleList(raw) {
+	const match = raw.match(/^\[(.+)]$/)
+	if (!match) {
+		return []
+	}
+	return match[1].split(',').map(s => s.trim()).filter(Boolean)
+}
+
 /**
  * Discover all Cargo.toml manifest paths in a Cargo workspace.
  * Uses `cargo metadata` to get workspace members.

test/providers/tst_manifests/maven/maven_multi_module/module-a/pom.xml

@@ -0,0 +1,9 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.example</groupId>
+    <artifactId>parent</artifactId>
+    <version>1.0.0</version>
+  </parent>
+  <artifactId>module-a</artifactId>
+</project>

test/providers/tst_manifests/maven/maven_multi_module/module-b/pom.xml

@@ -0,0 +1,9 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.example</groupId>
+    <artifactId>parent</artifactId>
+    <version>1.0.0</version>
+  </parent>
+  <artifactId>module-b</artifactId>
+</project>

test/providers/tst_manifests/maven/maven_multi_module/pom.xml

@@ -0,0 +1,11 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>parent</artifactId>
+  <version>1.0.0</version>
+  <packaging>pom</packaging>
+  <modules>
+    <module>module-a</module>
+    <module>module-b</module>
+  </modules>
+</project>

test/providers/tst_manifests/maven/maven_nested_aggregator/parent/child/pom.xml

@@ -0,0 +1,9 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.example</groupId>
+    <artifactId>parent</artifactId>
+    <version>1.0.0</version>
+  </parent>
+  <artifactId>child</artifactId>
+</project>

test/providers/tst_manifests/maven/maven_nested_aggregator/parent/pom.xml

@@ -0,0 +1,10 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>parent</artifactId>
+  <version>1.0.0</version>
+  <packaging>pom</packaging>
+  <modules>
+    <module>child</module>
+  </modules>
+</project>

test/providers/tst_manifests/maven/maven_nested_aggregator/pom.xml

@@ -0,0 +1,10 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>root</artifactId>
+  <version>1.0.0</version>
+  <packaging>pom</packaging>
+  <modules>
+    <module>parent</module>
+  </modules>
+</project>

test/providers/tst_manifests/maven/maven_no_modules/pom.xml

@@ -0,0 +1,6 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>single</artifactId>
+  <version>1.0.0</version>
+</project>