fix: parse multi-module Maven TGF dependency trees

`mvn dependency:tree -DoutputType=tgf` on a multi-module reactor emits one
TGF block per module (nodes, then a `#` separator, then edges), all
concatenated on stdout. depGraphFromMavenTGF used a single nodes→edges flag
that flipped to "edges" on the first `#` and never reset, so every module
after the first had its node lines dropped and its edges then referenced ids
that were never registered — failing the whole scan with
"maven tgf references unknown package".

Classify each line by shape instead — a node line ("<id> <coords>") or an
edge line ("<from> <to> <scope>") — which handles any number of concatenated
blocks. This is safe because node ids are global object hashcodes, unique
across the reactor (verified against a real 13-module reactor: zero id was
reused for a different coordinate across blocks), and node vs edge lines are
unambiguous (a node's second field is a coordinate with colons; an edge's is
a numeric id).

Adds a 3-block testdata fixture + TestMavenTGFMultiModule covering nodes,
edges, and scopes from the 2nd and 3rd blocks (fails on the old parser with
the exact "unknown package" error). Verified end to end on the Internet2
Grouper 4.x reactor: the maven detector went from total failure to resolving
137 vulnerable packages / 191 findings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bomly-guy

internal/detectors/maven/detector.go

@@ -242,7 +242,6 @@ func depGraphFromMavenTGF(raw []byte) (*sdk.Graph, error) {
 	// dependency trees (or single nodes with very long coordinate strings)
 	// routinely exceed that and fail with "token too long", so raise the cap.
 	scanner.Buffer(make([]byte, 0, 64*1024), maxTGFTokenSize)
-	inEdges := false
 
 	tgfPackages := make(map[string]*sdk.Dependency)
 	tgfGraph := sdk.New()
@@ -252,20 +251,31 @@ func depGraphFromMavenTGF(raw []byte) (*sdk.Graph, error) {
 	}
 	relationships := make([]edge, 0, 16)
 
+	// `mvn dependency:tree -DoutputType=tgf` on a multi-module reactor emits
+	// ONE TGF block per module (nodes, then a `#` separator, then edges),
+	// all concatenated on stdout. Node ids are global object hashcodes,
+	// unique across the whole reactor — verified against a real 13-module
+	// reactor: zero id was reused for a different coordinate across blocks.
+	// So we classify each line by its SHAPE — a node line ("<id> <coords>")
+	// or an edge line ("<from> <to> <scope>") — instead of relying on a
+	// single nodes→edges transition. The previous single `#` flag flipped to
+	// "edges" on the first module and never reset, so every later block's
+	// node lines were dropped and their edges then referenced ids that were
+	// never registered ("maven tgf references unknown package"). Node and
+	// edge lines are unambiguous (a node's second field is a coordinate with
+	// colons; an edge's second field is a numeric id), and nodes are checked
+	// first, so a shape check is safe.
 	for scanner.Scan() {
 		line, ok := normalizeMavenTGFLine(scanner.Text())
 		if !ok {
 			continue
 		}
-		if line == "#" {
-			inEdges = true
+		switch {
+		case line == "#":
+			// Block/section separator; classification is by shape, so there
+			// is nothing to track across it.
 			continue
-		}
-
-		if !inEdges {
-			if !looksLikeTGFNodeLine(line) {
-				continue
-			}
+		case looksLikeTGFNodeLine(line):
 			id, node, err := parseTGFNodeLine(line)
 			if err != nil {
 				return nil, err
@@ -276,14 +286,10 @@ func depGraphFromMavenTGF(raw []byte) (*sdk.Graph, error) {
 			} else if err := tgfGraph.AddNode(node); err != nil && !errors.Is(err, sdk.ErrNodeAlreadyExist) {
 				return nil, fmt.Errorf("add maven package %q: %w", node.ID, err)
 			}
-			continue
-		}
-
-		if !looksLikeTGFEdgeLine(line) {
-			continue
+		case looksLikeTGFEdgeLine(line):
+			fields := strings.Fields(line)
+			relationships = append(relationships, edge{from: fields[0], to: fields[1]})
 		}
-		fields := strings.Fields(line)
-		relationships = append(relationships, edge{from: fields[0], to: fields[1]})
 	}
 
 	if err := scanner.Err(); err != nil {

internal/detectors/maven/fixture_test.go

@@ -8,6 +8,48 @@ import (
 	"github.com/bomly-dev/bomly-cli/sdk"
 )
 
+// TestMavenTGFMultiModule verifies the parser handles a multi-module reactor,
+// where `mvn dependency:tree -DoutputType=tgf` emits one TGF block per module
+// (nodes, `#`, edges) concatenated. Regression for a real failure on a
+// 13-module reactor: the old single nodes→edges flag dropped every block after
+// the first, so their edges referenced ids that were never registered
+// ("maven tgf references unknown package"). The fixture has three blocks; the
+// assertions cover nodes and edges from the 2nd and 3rd blocks specifically.
+func TestMavenTGFMultiModule(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("testdata", "dependency-tree-multimodule.tgf"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	g, err := depGraphFromMavenTGF(raw)
+	if err != nil {
+		t.Fatalf("depGraphFromMavenTGF: %v", err)
+	}
+
+	for _, want := range []string{
+		"com.bomly:module-a@1.0.0",
+		"org.apache.commons:commons-lang3@3.12.0",
+		"com.bomly:module-b@1.0.0",
+		"com.fasterxml.jackson.core:jackson-databind@2.13.0",
+		"org.yaml:snakeyaml@1.30",
+		"com.bomly:module-c@1.0.0",
+		"junit:junit@4.13.2",
+		"org.hamcrest:hamcrest-core@1.3",
+	} {
+		if _, ok := g.Node(want); !ok {
+			t.Errorf("missing node %s", want)
+		}
+	}
+
+	// Edges from the 2nd and 3rd blocks — the ones the old parser lost.
+	requireMavenEdge(t, g, "com.bomly:module-b@1.0.0", "com.fasterxml.jackson.core:jackson-databind@2.13.0")
+	requireMavenEdge(t, g, "com.fasterxml.jackson.core:jackson-databind@2.13.0", "org.yaml:snakeyaml@1.30")
+	requireMavenEdge(t, g, "com.bomly:module-c@1.0.0", "junit:junit@4.13.2")
+	requireMavenEdge(t, g, "junit:junit@4.13.2", "org.hamcrest:hamcrest-core@1.3")
+
+	requireMavenScope(t, g, "org.yaml:snakeyaml@1.30", sdk.ScopeRuntime)
+	requireMavenScope(t, g, "junit:junit@4.13.2", sdk.ScopeDevelopment)
+}
+
 // TestMavenTGFFixture drives the dependency-tree (TGF) parser against a committed
 // fixture captured from `mvn dependency:tree -DoutputType=tgf`, so it exercises
 // the real output shape without invoking Maven.

internal/detectors/maven/testdata/dependency-tree-multimodule.tgf

@@ -0,0 +1,16 @@
+105194717 com.bomly:module-a:jar:1.0.0
+366752671 org.apache.commons:commons-lang3:jar:3.12.0:compile
+#
+105194717 366752671 compile
+773708944 com.bomly:module-b:jar:1.0.0
+834153999 com.fasterxml.jackson.core:jackson-databind:jar:2.13.0:compile
+399683701 org.yaml:snakeyaml:jar:1.30:compile
+#
+773708944 834153999 compile
+834153999 399683701 compile
+1274547241 com.bomly:module-c:jar:1.0.0
+1364958538 junit:junit:jar:4.13.2:test
+1858779250 org.hamcrest:hamcrest-core:jar:1.3:test
+#
+1274547241 1364958538 test
+1364958538 1858779250 test