test(java): scan pom.xml integration tests offline to avoid Maven Central rate limits

The pom.xml fixture used in integration tests declares jackson-databind as a
direct dependency. Resolving its transitive dependencies fetches POMs from
Maven Central, which now returns 429 Too Many Requests due to tightened rate
limits. Since aquasecurity#10693 a 429 is a fatal error, so these tests fail
intermittently (the limit is per-IP and accumulates across a CI job).

The golden files contain only the direct jackson-databind dependency, so
offline scanning produces identical output while removing the dependency on a
live Maven Central. Run the three pom.xml integration tests with
--offline-scan. Remote resolution stays covered by the pom parser unit tests.

Author: DmitriyLewen

integration/client_server_test.go

@@ -37,6 +37,7 @@ type csArgs struct {
 	secretConfig        string
 	Distro              string
 	VulnSeveritySources []string
+	OfflineScan         bool
 }
 
 // TestClientServer tests the client-server mode of Trivy.
@@ -282,6 +283,7 @@ func TestClientServer(t *testing.T) {
 				Command:          "repo",
 				RemoteAddrOption: "--server",
 				Target:           "testdata/fixtures/repo/pom/",
+				OfflineScan:      true,
 			},
 			golden: goldenPom,
 		},
@@ -727,6 +729,9 @@ func setupClient(t *testing.T, c csArgs, addr, cacheDir string) []string {
 	if c.IgnoreUnfixed {
 		osArgs = append(osArgs, "--ignore-unfixed")
 	}
+	if c.OfflineScan {
+		osArgs = append(osArgs, "--offline-scan")
+	}
 	if len(c.Severity) != 0 {
 		osArgs = append(osArgs,
 			"--severity", strings.Join(c.Severity, ","),

integration/repo_test.go

@@ -36,6 +36,7 @@ type repoTestArgs struct {
 	vex                        string
 	vulnSeveritySources        []string
 	tfExcludeDownloadedModules bool
+	offlineScan                bool
 }
 
 // TestRepository tests `trivy repo` with the local code repositories.
@@ -210,8 +211,9 @@ func TestRepository(t *testing.T) {
 		{
 			name: "pom",
 			args: repoTestArgs{
-				scanner: types.VulnerabilityScanner,
-				input:   "testdata/fixtures/repo/pom",
+				scanner:     types.VulnerabilityScanner,
+				input:       "testdata/fixtures/repo/pom",
+				offlineScan: true,
 			},
 			golden: goldenPom,
 		},
@@ -481,10 +483,11 @@ func TestRepository(t *testing.T) {
 		{
 			name: "pom.xml generating CycloneDX SBOM (with vulnerabilities)",
 			args: repoTestArgs{
-				command: "fs",
-				scanner: types.VulnerabilityScanner,
-				format:  "cyclonedx",
-				input:   "testdata/fixtures/repo/pom",
+				command:     "fs",
+				scanner:     types.VulnerabilityScanner,
+				format:      "cyclonedx",
+				input:       "testdata/fixtures/repo/pom",
+				offlineScan: true,
 			},
 			golden: goldenPomCycloneDX,
 		},
@@ -691,6 +694,9 @@ func buildArgs(t *testing.T, cacheDir, command string, format types.Format, test
 	if testArgs.tfExcludeDownloadedModules {
 		osArgs = append(osArgs, "--tf-exclude-downloaded-modules")
 	}
+	if testArgs.offlineScan {
+		osArgs = append(osArgs, "--offline-scan")
+	}
 
 	return osArgs
 }