fix: handle long classpaths

[muscar]

• Tests written and linted ℹ︎
• Documentation written ℹ︎
• Commit history is tidy ℹ︎

What this does

This change set updates the maven wrapper to use only plugins for determining the classpath we pass to the call graph builder. It uses dependency:build-classpath to get the classpath for the dependencies. Sadly, that doesn't include the output directory (I tried to set the scope to compile, but I couldn't get it to add the output directory to the classpath it gives back). To work around this, it uses help:evaluate to get project.build.outputDirectory, and append it to the classpath manually.

This has a few advantages:

• it's not limited by the maximum length of the command line on any given platform;
• it doesn't have to parse maven output;

and a few shortcomings:

• it needs to use temporary files because I couldn't find a way to make maven not produce logs;
• it needs an extra plugin maven-help, but that seems to be available without having to add it to the POM file.

It's been tested on macOS and Windows, and it gives the same results as the current approach.

For context: https://snyk.slack.com/archives/C07N668DA/p1605690001356600

Notes for the reviewer

I've opted to keep the current method as a fallback. We'll remove it when we can confirm this works in the wild.

More information

• Jira ticket FLOW-487

[SarahU]

it needs an extra plugin maven-help, but that seems to be available without having to add it to the POM file - I double checked this locally so can concur. Seems to require an installation but no POM changes

[snyksec]

🎉 This PR is included in version 1.16.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀