feat(java): drive the analyzer through the codeanalyzer-java wheel and drop the bundled jar and JDK download

The Java backend now gets both the analyzer and the JVM it runs on from the
codeanalyzer-java PyPI wheel, pinned at 3.0.2 behind a new optional `java`
extra. 3.0.2 reads its primordial scope from `jrt:/` in the running JVM, so
nothing needs `JAVA_HOME` or a `jmods/` directory any more:

* `JCodeanalyzer._get_codeanalyzer_exec` returns `codeanalyzer_java.command()`.
  The import is lazy, so `import cldk` and `import cldk.analysis.java` work
  without the extra; running the backend without it raises
  CodeanalyzerExecutionException naming the distribution and
  `pip install "cldk[java]"`.
* Deleted `cldk/analysis/java/codeanalyzer/_jdk.py` (`ensure_jdk`, the pinned
  Temurin download, the ~200 MB per-project JDK cache), the checked-in
  `codeanalyzer-2.4.1.jar` and its directory, the `[tool.hatch.build]`
  force-include, the root `.gitignore` `*.jar` rule and the
  `CLDK_CODEANALYZER_JAVA_JAR` seam the e2e grew while the tree's jar was stale.
* release.yml no longer downloads the pinned jar from the codeanalyzer-java
  GitHub release and no longer verifies a jar is bundled in the wheel and
  sdist. This retires the mechanism #284, #336 and #337 patched: the wheel pin
  is now the single source of the analyzer version, and nothing is fetched at
  build time.
* Extras take the thin-base shape 2.0 is heading for: `neo4j`, `java`, and
  `all = ["cldk[java]", "cldk[neo4j]"]`. codeanalyzer-python and
  codeanalyzer-typescript stay hard dependencies until #340.
* Fixtures regenerated at 3.0.2 with the command lines the v2 README records;
  the only content delta against the 3.0.1 pair is `analyzer.version` (verified
  by recursive parsed-JSON compare: one differing leaf per file).

Verified: the wheel path with `JAVA_HOME` unset and no JDK on PATH returns the
identical daytrader8 `-a 4` call-graph edge set the 3.0.1 jar returned on the
provisioned Temurin -- 1862 edges, 1378 `declared+rta` / 375 `rta` / 109
`declared`, symmetric difference 0 after normalising the app name. A wheel built
from this tree contains no `.jar`, and neither does the sdist.

Closes #339

Author: rahlk

.github/workflows/release.yml

@@ -65,56 +65,9 @@ jobs:
           git push --delete origin ${GITHUB_REF#refs/tags/}
           exit 1
 
-      - name: Inject the pinned Code Analyzer JAR
-        run: |
-          # The pin in pyproject.toml is authoritative: fetch exactly that release's
-          # versioned jar (codeanalyzer-<pin>.jar). A pin without a matching asset fails
-          # the step, and the gate below deletes the tag - never fall back to latest.
-          PIN=$(grep -E '^codeanalyzer-java\s*=' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/')
-          test -n "$PIN"
-          CODE_ANALYZER_URL=$(curl -sf "https://api.github.com/repos/codellm-devkit/codeanalyzer-java/releases/tags/v${PIN}" | jq -er --arg n "codeanalyzer-${PIN}.jar" '.assets[] | select(.name == $n) | .browser_download_url')
-          echo "Downloading: $CODE_ANALYZER_URL"
-          wget -q "$CODE_ANALYZER_URL"
-          mkdir -p ${{ github.workspace }}/cldk/analysis/java/codeanalyzer/jar/
-          rm -f ${{ github.workspace }}/cldk/analysis/java/codeanalyzer/jar/codeanalyzer-*.jar
-          mv "codeanalyzer-${PIN}.jar" ${{ github.workspace }}/cldk/analysis/java/codeanalyzer/jar/
-
       - name: Build Package
         run: uv build
 
-      - name: Verify the codeanalyzer JAR is bundled
-        # Guard against the hatchling/.gitignore regression (issue #284): a jarless wheel
-        # installs fine but fails at runtime with "codeanalyzer jar not found". Fail the
-        # release here rather than publish a broken artifact to PyPI.
-        #
-        # The listing is captured before grepping: piping `tar tzf` (which decompresses the
-        # whole 32MB sdist) straight into `grep -q` lets grep close the pipe on first match,
-        # SIGPIPE-killing tar and — under `pipefail` — reporting a false "missing JAR".
-        run: |
-          set -euo pipefail
-          PIN=$(grep -E '^codeanalyzer-java\s*=' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/')
-          jar_re='codeanalyzer/jar/codeanalyzer-[0-9][^/]*\.jar$'
-          fail=0
-          for f in dist/*.whl dist/*.tar.gz; do
-            case "$f" in
-              *.whl)    listing=$(unzip -l "$f") ;;
-              *.tar.gz) listing=$(tar tzf "$f") ;;
-            esac
-            # Exactly one jar, and it is the pinned one (issue #336: a stray second jar
-            # from a mismatched download must fail the release, not ride along).
-            jars=$(grep -oE "$jar_re" <<<"$listing" || true)
-            if [ "$(wc -l <<<"$jars" | tr -d ' ')" = "1" ] && [ -n "$jars" ] && grep -qF "codeanalyzer-${PIN}.jar" <<<"$jars"; then
-              echo "  ✓ $f ($jars)"
-            else
-              echo "::error::$f must bundle exactly codeanalyzer-${PIN}.jar; found: ${jars:-none}"
-              fail=1
-            fi
-          done
-          if [ "$fail" -ne 0 ]; then
-            echo "Refusing to publish a jarless release."; exit 1
-          fi
-          echo "codeanalyzer JAR present in wheel and sdist ✓"
-
       - name: Extract release notes from CHANGELOG.md
         id: notes
         # Source the release body from the hand-written CHANGELOG.md section for this tag —

.gitignore

@@ -25,7 +25,6 @@
 .mtj.tmp/
 
 # Package Files #
-*.jar
 *.war
 *.nar
 *.ear

CHANGELOG.md

@@ -66,6 +66,49 @@ plans `docs/design/plans/2026-09-06-leg-2.5a-typescript-schema-v2.md` and
   the fix ships.
 
 ### Changed (leg 2.5a)
+- **The Java analyzer comes from the `codeanalyzer-java` PyPI wheel, behind a new `java` extra**
+  (`pip install "cldk[java]"`). `pyproject.toml` gains `[project.optional-dependencies] java =
+  ["codeanalyzer-java==3.0.2"]` and `[tool.backend-versions] codeanalyzer-java = "3.0.2"`, which is
+  now the single source of the analyzer version. `JCodeanalyzer._get_codeanalyzer_exec` returns
+  `codeanalyzer_java.command()` — the wheel's jar run on the JVM the wheel bundles (`jdk4py`,
+  Temurin 21). The import is lazy, so `import cldk` and `import cldk.analysis.java` work without the
+  extra; running the backend without it raises `CodeanalyzerExecutionException` naming the
+  `codeanalyzer-java` distribution and the `pip install "cldk[java]"` line.
+  **Why an extra:** the wheel carries a ~35 MB JVM that an install analyzing only Python or
+  TypeScript never runs, and `jdk4py`'s PyPI classifier reads bare `GPLv2` (see below), which trips
+  policy gates for consumers who never touch Java. This is the **first step of a thin-base,
+  additive-extras split**, not the whole of it:
+
+  | Install | What you get |
+  |---|---|
+  | `pip install cldk` | the facades, the models, and the Python and TypeScript analyzers |
+  | `pip install "cldk[neo4j]"` | the above plus the Neo4j driver for the read-only graph backends (no analyzer) |
+  | `pip install "cldk[java]"` | the above plus the Java analyzer jar and its bundled JVM |
+  | `pip install "cldk[all]"` | everything |
+
+  `codeanalyzer-python` and `codeanalyzer-typescript` are still installed **unconditionally**; #340
+  moves them into extras of their own and grows `all` accordingly.
+  **Licensing, stated plainly:** `jdk4py` ships OpenJDK under GPLv2 **with the Classpath Exception**
+  (the ordinary OpenJDK terms; the exception is what permits Apache-2.0 code to run on it), but its
+  PyPI classifier says plain GPLv2 and its metadata carries no license file, so license scanners
+  keyed to classifiers will now see a GPLv2 row where the previous runtime JDK download was
+  invisible to dependency tooling.
+- **The Java release plumbing is gone with the jar.** `.github/workflows/release.yml` no longer
+  downloads the pinned jar from the `codeanalyzer-java` GitHub release and no longer verifies that a
+  jar is bundled in the wheel and sdist — the mechanism issues #284, #336 and #337 patched. The
+  analyzer arrives as a normal locked dependency; nothing is fetched at build time.
+
+### Removed
+- **`cldk/analysis/java/codeanalyzer/jar/` and the checked-in `codeanalyzer-2.4.1.jar`**, the
+  `[tool.hatch.build] artifacts` force-include that shipped it, and the root `.gitignore`'s `*.jar`
+  rule. The `cldk` wheel and sdist no longer contain a `.jar` (~35 MB smaller).
+- **`cldk/analysis/java/codeanalyzer/_jdk.py`** (`ensure_jdk`, `JdkLoader`, the pinned Temurin
+  `jdk-21.0.5+11`). codeanalyzer-java 3.0.x reads its primordial scope from `jrt:/` in the running
+  JVM, so no `jmods/` is needed: **the SDK downloads no JDK (~200 MB per project cache), and reads
+  or writes no `JAVA_HOME`** — a `JAVA_HOME` already in the environment is left exactly as it is.
+  `pip install "cldk[java]"` now works on a machine with no Java at all. The `<cache>/java/jdk/`
+  cache directory is simply unused; delete it by hand if you want the space back. The
+  `CLDK_CODEANALYZER_JAVA_JAR` test/dev seam is removed with it — the wheel is the source of the jar.
 - **Pinned `codeanalyzer-typescript` 0.4.3 → 1.2.0** (`pyproject.toml` `dependencies` and
   `[tool.backend-versions]`). The analyzer emits canonical schema v2, and `cldk.models.typescript`
   is rewritten as an `extra="forbid"` mirror of it: `analysis.json` is the `TSAnalysis` envelope

CLAUDE.md

@@ -10,7 +10,7 @@ an optional read-only Neo4j backend — selected by the *type* of the `backend=`
 
 | Language | Entry point | Local backend | Neo4j backend | Models |
 |----------|-------------|---------------|---------------|--------|
-| Java | `CLDK.java(...)` | `JCodeanalyzer` (codeanalyzer-java 3.0.1 JAR, subprocess, `-a 1..4`) | `JNeo4jBackend` (3.0.1 graph, probed at attach) | `cldk/models/java/` (schema v2 mirror) |
+| Java | `CLDK.java(...)` (needs the `cldk[java]` extra) | `JCodeanalyzer` (the `codeanalyzer-java` 3.0.2 wheel's jar on its bundled JVM, subprocess, `-a 1..4` — no jar in this repo, no JDK download) | `JNeo4jBackend` (3.0.1 graph, probed at attach) | `cldk/models/java/` (schema v2 mirror) |
 | Python | `CLDK.python(...)` | `PyCodeanalyzer` (in-process `codeanalyzer-python`) | `PyNeo4jBackend` | re-exported from `codeanalyzer-python` |
 | TypeScript (+ JavaScript modules) | `CLDK.typescript(...)` | `TSCodeanalyzer` (`codeanalyzer-typescript` 1.3.0 binary from the wheel, subprocess; `-a 1..4`, but `--emit neo4j` takes no `-a` and is always full depth) | `TSNeo4jBackend` (graphs emitted by ≥ 1.3.0; older refused at attach) | `cldk/models/typescript/` (schema v2 mirror) |
 

cldk/analysis/java/codeanalyzer/__init__.py

@@ -20,10 +20,4 @@
 
 from .codeanalyzer import JCodeanalyzer
 
-
-"""
-Download the codeanalyzer.jar file from the latest release on the codeanalyzer repository.
-"""
-
-
 __all__ = ["JCodeanalyzer"]