[leftibot]

Closes #66. Phase 4 of #107. Stacked on #124: the branch lives on a fork, so this PR targets main and also contains #124's commit. Review only the last commit (3d67cae). Once #124 merges, this PR shows just that commit.

project_validator/ecosystems/jvm.py judges Java (.java) and Kotlin (.kt) projects built with Maven (pom.xml) or Gradle (build.gradle(.kts), settings.gradle(.kts)). .kts and .gradle scripts add no language, because they are mostly builds.

The build counts as CI configuration. JVM projects wire their tools into the build:

• A Maven plugin binds a goal to a phase (<goal>check</goal> runs in mvn verify).
• A Gradle plugin adds its task to check.

So the build files count as evidence when CI runs the build far enough:

• Compiler flags need any compiling phase or task (mvn test, gradle build).
• Verification plugins need mvn verify / install / deploy or gradle check / build.
• A Maven plugin counts only when an execution binds the goal. For example, jacoco-maven-plugin with only prepare-agent reports nothing.

Practice	Passes when
tests-run	@Test methods (JUnit, TestNG) or Kotest specs under src/test/java or src/test/kotlin, run by mvn test / verify or gradle test / check / build
coverage	JaCoCo (report goal bound, jacoco:report, jacocoTestReport) or Kover. Both report branches; neither reports path coverage, so there is no bonus
code-formatting	Spotless (spotless:check bound, spotlessCheck, or the com.diffplug.spotless Gradle plugin), fmt-maven-plugin, google-java-format --set-exit-if-changed, ktfmt --set-exit-if-changed, or ktlint (not -F, and also as the jlleitschuh Gradle plugin)
compiler-warnings	Java: -Xlint:all (or -Xlint). A Kotlin-only project passes on Kotlin's default warnings, as #66 says; a mixed project still needs -Xlint:all
warnings-as-errors	-Werror (javac or kotlinc) or allWarningsAsErrors = true
dependency-audit	OWASP dependency-check: dependency-check-maven bound to check / aggregate, dependencyCheckAnalyze, the CLI or the action. Applying the Gradle plugin alone does not count, because it adds no task to check
security-scanning	SpotBugs with Find Security Bugs, or PMD's category/java/security.xml
function-limits	lizard runs; or Checkstyle runs with MethodLength (it warns when the check is configured but Checkstyle never runs); or detekt runs, since its LongMethod rule is on unless the config turns it off
static-analysis	Error Prone, SpotBugs, PMD (not pmd cpd), Checkstyle or detekt runs
dependency-management	<dependency> entries in pom.xml or Gradle implementation / api / ... are verified: a committed gradle/verification-metadata.xml or gradle.lockfile, or Maven with --strict-checksums (in CI or .mvn/maven.config)
vcs-ignore / committed-artifacts	Maven ignores target/, Gradle ignores build/. *.class files, plus target/ or build/ and .gradle/, must not be committed
platform-matrix	CI runs at least two JDK versions (java-version, or eclipse-temurin: / openjdk: / amazoncorretto: / maven:…-21 / gradle:…jdk21 images)

hardening and ci-build-types do not apply, because the JVM builds bytecode, not a native binary. type-checking does not apply either, because both languages are statically typed. The build-tool-version row is left for #21.

target/ beside a pom.xml and build/ beside a Gradle build are treated as build output, so they are never inspected.

Changes outside the profile (please review)

These follow the same idea as Formatter.texts in #124: work with how the ecosystem is normally set up.

• DependencyAudit gets the same optional texts field (default: CI configuration). Without it, dependency-check bound in pom.xml and run by mvn verify would never count. dependency-audit reads it, a one-line change.
• vcs-ignore now judges the BuildOutputs rule of the build system a project uses, as committed-artifacts already did. Add a JVM ecosystem profile (Java and Kotlin, with Maven and Gradle) #66 asks for Maven target/ vs Gradle build/, and before this vcs-ignore read only an ecosystem's own rule. The shared helper is judge_each_ecosystem, which practice now uses too. Results for every existing ecosystem are unchanged, because none of them has a build-system BuildOutputs rule.

Notes

• --strict-checksums is weaker than Gradle's verification. It only makes Maven fail on a repository checksum mismatch, which is much weaker than Gradle's verification metadata. It is in because Add a JVM ecosystem profile (Java and Kotlin, with Maven and Gradle) #66 lists it.
• License is not compared. pom.xml names licenses in prose (Apache License, Version 2.0), not SPDX, so this profile has no DeclaredLicense rule.
• Test helpers. tests/support.py gains checks_named, so tests don't repeat the same import block (jscpd flagged it), and run_in_layout, which feat: add a JavaScript/TypeScript ecosystem profile #124's tests now use too.

Tests

• tests/fixtures/well_configured_jvm is a Maven project whose plugins are bound in pom.xml and run by mvn --strict-checksums verify. It passes every check that applies.
• tests/fixtures/bare_jvm fails or warns on every JVM practice. It commits a target/ directory.
• tests/test_jvm.py covers lifecycle gating, the Gradle paths, Kotlin-only warnings, and per-build-system ignores. There are two new layouts: Maven Java and Gradle Kotlin.
• In the existing snapshots, only the "applies to" lists inside SKIP messages change.

Local gates all pass:

• python -W error -m unittest
• ruff check and format
• strict mypy
• branch coverage 99% (jvm.py 100%)
• lizard --length 30
• jscpd: 0 clones
• strict self-validation

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.67%. Comparing base (7f93afa) to head (3d67cae).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #125      +/-   ##
==========================================
+ Coverage   98.51%   98.67%   +0.15%     
==========================================
  Files          58       60       +2     
  Lines        2297     2564     +267     
  Branches      231      254      +23     
==========================================
+ Hits         2263     2530     +267     
  Misses         28       28              
  Partials        6        6              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[leftibot]

Moved to leftibot#1, stacked on javascript-profile (#124) on the fork until the stack can live upstream.