Add Java/Gradle gradle.lockfile support (#20)

Adds GradleParser that parses line-oriented gradle.lockfile entries in
<group>:<artifact>:<version>=<configurations> format. Marks dependencies
as Dev when they only appear in test* configurations. Produces
pkg:maven/ PURLs with Sonatype Central external references; the artifact
portion is used as the component display name.

Closes #13

Author: sns45

internal/lockfile/gradle.go

@@ -0,0 +1,74 @@
+package lockfile
+
+import (
+	"bufio"
+	"context"
+	"io"
+	"strings"
+)
+
+// GradleParser handles Gradle dependency lockfiles (gradle.lockfile).
+type GradleParser struct{}
+
+func (p *GradleParser) Type() LockfileType  { return TypeGradleLock }
+func (p *GradleParser) Filenames() []string { return []string{"gradle.lockfile"} }
+
+func (p *GradleParser) Parse(ctx context.Context, r io.Reader) (*LockfileResult, error) {
+	result := &LockfileResult{Type: TypeGradleLock}
+
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		// Lines like "empty=..." list configurations with no dependencies; skip.
+		if strings.HasPrefix(line, "empty=") {
+			continue
+		}
+
+		eqIdx := strings.LastIndex(line, "=")
+		if eqIdx < 0 {
+			continue
+		}
+		coord := line[:eqIdx]
+		configs := line[eqIdx+1:]
+
+		parts := strings.Split(coord, ":")
+		if len(parts) != 3 {
+			continue
+		}
+		group, artifact, version := parts[0], parts[1], parts[2]
+		if group == "" || artifact == "" || version == "" {
+			continue
+		}
+
+		result.Packages = append(result.Packages, Package{
+			Name:    group + ":" + artifact,
+			Version: version,
+			Dev:     isGradleTestOnly(configs),
+		})
+	}
+
+	return result, scanner.Err()
+}
+
+// isGradleTestOnly returns true when every configuration in the CSV starts
+// with "test" (case-insensitive). Empty input returns false.
+func isGradleTestOnly(configs string) bool {
+	configs = strings.TrimSpace(configs)
+	if configs == "" {
+		return false
+	}
+	for _, c := range strings.Split(configs, ",") {
+		c = strings.TrimSpace(c)
+		if c == "" {
+			continue
+		}
+		if !strings.HasPrefix(strings.ToLower(c), "test") {
+			return false
+		}
+	}
+	return true
+}

internal/lockfile/gradle_test.go

@@ -0,0 +1,85 @@
+package lockfile
+
+import (
+	"context"
+	"os"
+	"testing"
+)
+
+func TestGradleParser(t *testing.T) {
+	f, err := os.Open("../../testdata/lockfiles/gradle/gradle.lockfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+
+	parser := &GradleParser{}
+	result, err := parser.Parse(context.Background(), f)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if result.Type != TypeGradleLock {
+		t.Errorf("expected type %s, got %s", TypeGradleLock, result.Type)
+	}
+
+	if len(result.Packages) != 10 {
+		t.Fatalf("expected 10 packages, got %d", len(result.Packages))
+	}
+
+	found := make(map[string]Package)
+	for _, pkg := range result.Packages {
+		found[pkg.Name] = pkg
+	}
+
+	// Coordinate format: group:artifact.
+	if pkg, ok := found["org.springframework:spring-core"]; !ok {
+		t.Error("missing spring-core")
+	} else if pkg.Version != "6.1.2" {
+		t.Errorf("spring-core version: got %s, want 6.1.2", pkg.Version)
+	}
+
+	// Production dep should not be dev.
+	if pkg := found["com.google.guava:guava"]; pkg.Dev {
+		t.Error("guava should not be marked dev")
+	}
+
+	// Test-only deps should be Dev=true.
+	if pkg, ok := found["org.junit.jupiter:junit-jupiter-api"]; !ok {
+		t.Error("missing junit-jupiter-api")
+	} else if !pkg.Dev {
+		t.Error("junit-jupiter-api should be marked dev")
+	}
+	if pkg := found["org.mockito:mockito-core"]; !pkg.Dev {
+		t.Error("mockito-core should be marked dev")
+	}
+}
+
+func TestGradleDevDetection(t *testing.T) {
+	tests := []struct {
+		configs string
+		want    bool
+	}{
+		{"compileClasspath,runtimeClasspath", false},
+		{"testCompileClasspath,testRuntimeClasspath", true},
+		{"compileClasspath,testCompileClasspath", false},
+		{"testImplementation", true},
+		{"", false},
+	}
+	for _, tt := range tests {
+		got := isGradleTestOnly(tt.configs)
+		if got != tt.want {
+			t.Errorf("isGradleTestOnly(%q) = %v, want %v", tt.configs, got, tt.want)
+		}
+	}
+}
+
+func TestGradleParserType(t *testing.T) {
+	p := &GradleParser{}
+	if p.Type() != TypeGradleLock {
+		t.Errorf("expected %s, got %s", TypeGradleLock, p.Type())
+	}
+	if fnames := p.Filenames(); len(fnames) != 1 || fnames[0] != "gradle.lockfile" {
+		t.Errorf("unexpected filenames: %v", fnames)
+	}
+}

internal/lockfile/model.go

@@ -16,6 +16,7 @@ const (
 	TypeUV              LockfileType = "uv"
 	TypeGoMod           LockfileType = "gomod"
 	TypeCargoLock       LockfileType = "cargo"
+	TypeGradleLock      LockfileType = "gradle"
 )
 
 // Package represents a resolved dependency from a lockfile.

internal/lockfile/parser.go

@@ -51,6 +51,8 @@ func init() {
 		&GoModParser{},
 		// Rust
 		&CargoParser{},
+		// Java/Gradle
+		&GradleParser{},
 	}
 }
 

internal/sbom/cyclonedx.go

@@ -13,9 +13,16 @@ import (
 func mapComponent(pkg lockfile.Package, ecosystem string) cdx.Component {
 	purl := BuildPURL(pkg.Name, pkg.Version, ecosystem)
 
+	displayName := pkg.Name
+	if ecosystem == "maven" {
+		if idx := strings.Index(pkg.Name, ":"); idx > 0 {
+			displayName = pkg.Name[idx+1:]
+		}
+	}
+
 	comp := cdx.Component{
 		Type:    cdx.ComponentTypeLibrary,
-		Name:    pkg.Name,
+		Name:    displayName,
 		Version: pkg.Version,
 		BOMRef:  purl,
 		PackageURL: purl,
@@ -35,6 +42,8 @@ func mapComponent(pkg lockfile.Package, ecosystem string) cdx.Component {
 		registryURL = "https://pkg.go.dev/" + pkg.Name
 	case "cargo":
 		registryURL = "https://crates.io/crates/" + pkg.Name
+	case "maven":
+		registryURL = mavenRegistryURL(pkg.Name)
 	default:
 		registryURL = npmRegistryURL(pkg.Name)
 	}
@@ -103,6 +112,15 @@ func npmRegistryURL(name string) string {
 	return "https://www.npmjs.com/package/" + name
 }
 
+// mavenRegistryURL returns the Sonatype Central URL for a "group:artifact" coordinate.
+func mavenRegistryURL(name string) string {
+	parts := strings.SplitN(name, ":", 2)
+	if len(parts) != 2 {
+		return "https://central.sonatype.com/artifact/" + name
+	}
+	return "https://central.sonatype.com/artifact/" + parts[0] + "/" + parts[1]
+}
+
 // hashContent computes SHA-256 of the given content.
 func hashContent(data []byte) string {
 	h := sha256.Sum256(data)

internal/sbom/generator.go

@@ -43,6 +43,8 @@ func ecosystemFromLockfileType(lt lockfile.LockfileType) string {
 		return "golang"
 	case lockfile.TypeCargoLock:
 		return "cargo"
+	case lockfile.TypeGradleLock:
+		return "maven"
 	default:
 		return "npm"
 	}

internal/sbom/purl.go

@@ -17,6 +17,8 @@ func BuildPURL(name, version, ecosystem string) string {
 		return BuildGolangPURL(name, version)
 	case "cargo":
 		return BuildCargoPURL(name, version)
+	case "maven":
+		return BuildMavenPURL(name, version)
 	default:
 		return BuildNPMPURL(name, version)
 	}
@@ -28,6 +30,20 @@ func BuildCargoPURL(name, version string) string {
 	return purl.ToString()
 }
 
+// BuildMavenPURL constructs a Package URL for a Maven artifact.
+// The input `name` is expected to be "group:artifact".
+func BuildMavenPURL(name, version string) string {
+	var group, artifact string
+	if idx := strings.Index(name, ":"); idx > 0 {
+		group = name[:idx]
+		artifact = name[idx+1:]
+	} else {
+		artifact = name
+	}
+	purl := packageurl.NewPackageURL("maven", group, artifact, version, nil, "")
+	return purl.ToString()
+}
+
 // BuildGolangPURL constructs a Package URL for a Go module.
 // The full module path (e.g., github.com/gorilla/mux) is split on the last
 // '/' segment: namespace is the prefix, name is the last segment.

internal/sbom/purl_test.go

@@ -28,6 +28,9 @@ func TestBuildPURL(t *testing.T) {
 		// Cargo crates
 		{"serde", "1.0.124", "cargo", "pkg:cargo/serde@1.0.124"},
 		{"tokio", "1.36.0", "cargo", "pkg:cargo/tokio@1.36.0"},
+		// Maven (group:artifact in name)
+		{"org.apache.logging.log4j:log4j-core", "2.14.1", "maven", "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"},
+		{"com.google.guava:guava", "32.1.3-jre", "maven", "pkg:maven/com.google.guava/guava@32.1.3-jre"},
 	}
 
 	for _, tt := range tests {

internal/sbom/snapshot_test.go

@@ -127,7 +127,7 @@ func discoverSnapshotCases(t *testing.T) []snapshotCase {
 	knownFiles := []string{
 		"bun.lock", "pnpm-lock.yaml", "yarn.lock", "package-lock.json",
 		"uv.lock", "poetry.lock", "pdm.lock", "requirements.txt",
-		"go.mod", "Cargo.lock",
+		"go.mod", "Cargo.lock", "gradle.lockfile",
 	}
 
 	var cases []snapshotCase

testdata/lockfiles/gradle/gradle.lockfile

@@ -0,0 +1,14 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson.core:jackson-core:2.15.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.guava:guava:32.1.3-jre=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.13.0=compileClasspath,runtimeClasspath
+org.slf4j:slf4j-api:2.0.9=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.springframework:spring-core:6.1.2=compileClasspath,runtimeClasspath
+org.springframework:spring-context:6.1.2=compileClasspath,runtimeClasspath
+ch.qos.logback:logback-classic:1.4.14=runtimeClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.10.1=testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.10.1=testRuntimeClasspath
+org.mockito:mockito-core:5.8.0=testCompileClasspath,testRuntimeClasspath
+empty=annotationProcessor,testAnnotationProcessor