SONARJAVA-6276 Use mise action to install Maven if needed

[tomasz-tylenda-sonarsource]

Tested on a modified workflow in sonar-java:

• (master) https://github.com/SonarSource/sonar-java/actions/runs/24840114676/job/72711331533#step:3:106 fails due to missing mvn
• (tt/bump-version-mise) https://github.com/SonarSource/sonar-java/actions/runs/24840302500/job/72712023205 - mvn runs

[sonar-review-alpha]

Summary

This PR ensures Maven is installed when using the bump-version action with tool: maven. It adds a mise-action step to install Maven and JDK based on the calling repository's mise.toml configuration. A validation check was added to fail early if mise.toml is missing when Maven is requested. The author's workflow tests show that Maven is now available during the version bump operation.

What reviewers should know

Key changes in action.yml:

• New validation step (lines 28-37) checks for mise.toml when tool == 'maven' — this prevents confusing errors downstream if the file is missing
• New mise-action step (lines 39-43) runs after validation to install Maven/JDK from the specified mise.toml
• Both conditional steps only run when tool == 'maven', so non-Maven workflows are unaffected

Review notes:

• The mise-action version (2026.3.13) is pinned with a commit hash for reproducibility
• The check passes if mise.toml exists anywhere in the repository root (standard mise behavior)
• Callers must ensure their mise.toml includes maven and a JDK; mise-action will install both before the bump runs

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

The approach is sound and the action is correctly pinned (SHA + version comment, consistent with repo conventions). One open question about the mise.toml failure mode needs clarification before this can be approved.

🗣️ Give feedback

[hashicorp-vault-sonar-prod]

SONARJAVA-6276

[nils-werner-sonarsource]

LGTM! Have a look at the comment of the review bot. I think it's a valid point to inform why the run crashes because mise.toml is not available in the repository you are running on.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tomasz-tylenda-sonarsource]

LGTM! Have a look at the comment of the review bot. I think it's a valid point to inform why the run crashes because mise.toml is not available in the repository you are running on.

Added and tested: https://github.com/SonarSource/sonar-java/actions/runs/24883394793/job/72857275953#step:3:94

[sonar-review-alpha]

LGTM! ✅

The new commit resolves the missing-guard concern — mise.toml absence is now caught early with a clear error. One previously flagged issue is still open: the README documents the new requirement but does not mention that existing callers using tool: maven need to add mise.toml before upgrading. No new issues in this commit.

🗣️ Give feedback