Ivy CLI Detector: Transitive Dependency Support

[zahidblackduck]

JIRA Ticket

IDETECT-4963

Description

This merge request introduces a new Ivy CLI Detector that resolves transitive dependencies for Apache Ant + Ivy projects by leveraging the ivy:dependencytree task. Previously, all the dependencies were reported as direct dependencies by the existing LOW accuracy Ivy Build Parse Detector regardless they were transitive dependencies or not..

The new detector executes ant <targetName> to generate a complete dependency tree, then parses the hierarchical structure to identify direct dependencies, transitive dependencies, and parent-child relationships.

Requirements

• Apache Ant 1.6.0+
• Apache Ivy 2.4.0+
• ivy:dependencytree task in build.xml

Implementation

The detector automatically discovers the ivy:dependencytree target in build.xml and executes it. If not found, detection falls back to the existing xml parsing based Ivy Build Parse Detector (direct dependencies only).

User Action Required

Add the ivy:dependencytree target to build.xml:

<target name="dependencytree">
    <ivy:resolve />
    <ivy:dependencytree log="download-only" />
</target>

This is required to generate the dependency tree for parsing.

New Detect Properties

detect.ant.path=<path> - Specifies the ant executable path (optional)

[cpottsbd]

Suggestion:

• Extracts the project name and version from build.xml. If the project name or version is missing, the values are derived via Git from the project's directory or defaults.

[cpottsbd]

I'd suggest leaving this part out of the release notes as you have this information in the ivy.md page:
"Falls back to the Ivy Build Parse Detector if the task is not present in build.xml."

[bd-samratmuk]

This requires ivy.xml to exist in the project root as a precondition for applicability, but the extraction phase never actually reads it. It relies entirely on running ant which lets Ivy resolve the descriptor internally based on the project's own ivysettings.xml or build.xml configuration. This means projects that keep their Ivy module descriptor at a non-standard path (e.g., config/ivy-deps.xml) or under a different filename will have a fully working ivy:dependencytree target but the detector won't trigger. This is a rare edge case since the overwhelming majority of Ivy projects use the conventional ivy.xml in the root, and requiring it is a reasonable heuristic to confirm the project is Ivy-based but this assumption and its limitation should be documented.

[zahidblackduck]

Thanks Samrat for the suggestion. It is indeed an edge case but a possibility too. Nonetheless, we should document it. I should further investigate it and create a separate PR if the doc change is required.