Add input parameter for maven artifacts to public workflow

Author: JohT

.github/workflows/public-analyze-code-graph.yml

@@ -18,6 +18,14 @@ on:
         required: false
         type: string
         default: ''
+      maven-artifacts:
+        description: >
+          Comma-separated list of Maven coordinates (groupId:artifactId:version) 
+          to download from Maven Central for the analysis.
+          Example: 'org.apache.commons:commons-lang3:3.12.0,com.google.guava:guava:31.1-jre'
+        required: false
+        type: string
+        default: ''
       sources-upload-name:
         description: >
           The name of the sources uploaded with 'actions/upload-artifact' 
@@ -87,9 +95,9 @@ jobs:
           python: 3.12
           miniforge: 24.9.0-0
     steps:
-      - name: Assure that either artifacts-upload-name or sources-upload-name is set
-        if: inputs.artifacts-upload-name == '' && inputs.sources-upload-name == ''
-        run: echo "Please specify either the input parameter 'artifacts-upload-name' or 'sources-upload-name'."; exit 1
+      - name: Assure that either artifacts-upload-name or maven-artifacts or sources-upload-name is set
+        if: inputs.artifacts-upload-name == '' && inputs.maven-artifacts == ''  && inputs.sources-upload-name == ''
+        run: echo "Please specify either the input parameter 'artifacts-upload-name' or 'maven-artifacts' or 'sources-upload-name'."; exit 1
 
       - name: Assemble ENVIRONMENT_INFO
         run: echo "ENVIRONMENT_INFO=java-${{ matrix.java }}-python-${{ matrix.python }}-miniforge-${{ matrix.miniforge }}" >> $GITHUB_ENV
@@ -170,6 +178,11 @@ jobs:
           name: ${{ inputs.artifacts-upload-name }}
           path: temp/${{ inputs.analysis-name }}/artifacts
 
+      - name: (Code Analysis Setup) Download Maven artifacts for analysis
+        if: inputs.maven-artifacts != ''
+        working-directory: temp/${{ inputs.analysis-name }}
+        run: ./../../scripts/downloadMavenArtifacts.sh "${{ inputs.maven-artifacts }}"
+
       - name: (Debug) Log folder structure of temp directory
         if: runner.debug == '1'
         working-directory: temp

INTEGRATION.md

@@ -33,6 +33,7 @@ The workflow parameters are as follows:
 
 - **analysis-name**: The name of the project to analyze. Example: MyProject-1.0.0. This parameter is required and should be a string.
 - **artifacts-upload-name**: The name of the artifacts uploaded with [actions/upload-artifact](https://github.com/actions/upload-artifact/tree/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08) containing the content of the 'artifacts' directory for the analysis. This is used to analyze Java JARs, WARs, EARs, etc. This parameter is optional and defaults to an empty string.
+- **maven-artifacts**: Comma separated list of Maven artifact coordinates (groupId:artifactId:version) to download from Maven Central for the analysis. This is used to analyze Java artifacts without having to upload them as build artifacts. This parameter is optional and defaults to an empty string.
 - **sources-upload-name**: The name of the sources uploaded with [actions/upload-artifact](https://github.com/actions/upload-artifact/tree/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08) containing the content of the 'source' directory for the analysis. It also supports sub-folders for multiple source code bases. This parameter is optional and defaults to an empty string.
 Please use 'include-hidden-files: true' if you also want to upload the git history.
 - **ref**: The branch, tag, or SHA of the code-graph-analysis-pipeline to checkout. This parameter is optional and defaults to "main".

scripts/downloadMavenArtifacts.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+# Uses Maven to download specified Maven artifacts from Maven Central.
+# The artifacts are specified in the first argument as comma separated Maven coordinates.
+# Details on the Maven coordinates format: https://maven.apache.org/guides/mini/guide-naming-conventions.html
+# The downloaded files are written into the "artifacts" directory of the current analysis directory.
+
+# This script is used inside .github/workflows/public-analyze-code-graph.yml (November 2025)
+
+# Fail on any error ("-e" = exit on first error, "-o pipefail" exist on errors within piped commands)
+set -o errexit -o pipefail
+
+# Overrideable Constants (defaults also defined in sub scripts)
+LOG_GROUP_START=${LOG_GROUP_START:-"::group::"}
+LOG_GROUP_END=${LOG_GROUP_END:-"::endgroup::"}
+ARTIFACTS_DIRECTORY=${ARTIFACTS_DIRECTORY:-"artifacts"}
+
+# Local constants
+SCRIPT_NAME=$(basename "${0}")
+
+# Read the first unnamed input argument containing the Maven artifacts to download
+maven_artifacts=$1
+
+fail() {
+  local ERROR_COLOR='\033[0;31m' # red
+  local DEFAULT_COLOR='\033[0m'
+  local errorMessage="${1}"
+  echo -e "${ERROR_COLOR}${SCRIPT_NAME}: Error: ${errorMessage}${DEFAULT_COLOR}" >&2
+  exit 1
+}
+
+if [ -z "${maven_artifacts}" ]; then
+    fail "No Maven artifacts specified to download. Please provide a comma-separated list of Maven coordinates (groupId:artifactId:version)."
+fi
+
+if [ ! -d "./${ARTIFACTS_DIRECTORY}" ]; then
+    fail "This script needs to run inside the analysis directory with an already existing artifacts directory in it. Change into that directory or use ./init.sh to set up an analysis."
+fi
+
+if ! command -v "mvn" &> /dev/null ; then
+    fail "Command mvn (Maven) not found. It's needed to download Maven artifacts from Maven Central."
+fi
+
+# Process each Maven artifact coordinate
+echo "${maven_artifacts}" | tr ',' '\n' | while read -r maven_artifact; do
+    maven_artifact=$(echo "$maven_artifact" | xargs)
+    
+    # Check if the maven artifact "coordinate" contains exactly two colons
+    colon_count=$(echo "${maven_artifact}" | tr -cd ':' | wc -c)
+    if [ "${colon_count}" -ne 2 ]; then
+        fail "Invalid Maven artifact coordinates: '${maven_artifact}'. It should be in the format 'groupId:artifactId:version'."
+    fi
+
+    echo "${LOG_GROUP_START}Downloading Maven artifact ${maven_artifact}"
+    mvn --quiet dependency:copy -Dartifact="${maven_artifact}" -DoutputDirectory="./${ARTIFACTS_DIRECTORY}" -Dtransitive=false -Dsilent=true
+    echo "${LOG_GROUP_END}"
+done