fix(maven) add support for settings.xml only

README.md

@@ -335,6 +335,9 @@ build tool can authenticate with a `PAT`. Use the `with.github_token` field to a
 
 `with.mvn_opts` - (optional) additional maven options in a comma-delimited string.
 
+**NB!**  
+Currently only supports the maven command cli option `-s`, specifying a settings.xml file.
+
 Useful when your project depends on a custom maven settings file or use dependencies from a private repository.
 
 If project depends on dependencies from a private repository, actor need to set GitHub [private token](#access-private-repositories) with proper access right.
@@ -343,7 +346,7 @@ If project depends on dependencies from a private repository, actor need to set
  - name: Generate provenance, sign and upload image
    uses: nais/salsa@v0.x
    with:
-     mvn_opts: "-s ./.mvn/settings.xml, -Dmaven.repo.local=/path/to/local/repo"
+     mvn_opts: "-s .mvn/settings.xml"
      github_token: ${{ secrets.PAT }}
 ```
 

pkg/build/jvm/mvn.go

@@ -52,6 +52,7 @@ func (m Maven) ResolveDeps(workDir string) (*build.ArtifactDependencies, error)
 	if err != nil {
 		return nil, fmt.Errorf("scan: %v\n", err)
 	}
+
 	args := make([]string, 0)
 	args = append(args, cmd.Name)
 	args = append(args, cmd.SubCmd)
@@ -74,7 +75,7 @@ func (m Maven) parsedCmdOpts() []string {
 
 	parsed := strings.Split(m.CmdOptions, ",")
 	for i, s := range parsed {
-		parsed[i] = strings.TrimSpace(s)
+		parsed[i] = strings.ReplaceAll(s, " ", "")
 	}
 
 	return parsed

pkg/build/jvm/mvn_test.go

@@ -50,8 +50,8 @@ func TestBuildMaven(t *testing.T) {
 		},
 		{
 			Name:      "Add additional command line arguments as a part of the mvn command",
-			BuildType: BuildMaven("-q, -am, -X,-B, -D yolo=molo"),
-			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true -q -am -X -B -D yolo=molo",
+			BuildType: BuildMaven("-s .m2/maven-settings.xml"),
+			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true -s.m2/maven-settings.xml",
 			WorkDir:   "testdata/jvm/maven",
 			BuildPath: "/usr/local/bin/mvn",
 			Want: test.Want{

pkg/build/jvm/testdata/jvm/maven/.m2/maven-settings.xml

@@ -0,0 +1,14 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
+                      http://maven.apache.org/xsd/settings-1.0.0.xsd">
+
+    <servers>
+        <server>
+            <id>github</id>
+            <username>${GITHUB_USERNAME}</username>
+            <password>${GITHUB_TOKEN}</password>
+        </server>
+    </servers>
+
+</settings>

pkg/build/jvm/testdata/jvm/maven/target/dependency/com/google/code/gson/gson/maven-metadata-local.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.google.code.gson</groupId>
+  <artifactId>gson</artifactId>
+  <versioning>
+    <release>2.8.6</release>
+    <versions>
+      <version>2.8.6</version>
+    </versions>
+    <lastUpdated>20221116003142</lastUpdated>
+  </versioning>
+</metadata>