# Set up Semgrep Supply Chain with Apache Maven (Java)

Source: https://semgrep.dev/docs/semgrep-supply-chain/setup-maven/

- [](/docs/)- [Scan](/docs/getting-started/quickstart)- Set up and deploy scans- Core deployment- Scan repositories with the AppSec Platform- Configuring SCA scans- Apache Maven**On this page- [Deployment](/docs/tags/deployment)- [Semgrep Supply Chain](/docs/tags/semgrep-supply-chain)Set up Semgrep Supply Chain with Apache Maven (Java)
infoSemgrep Supply Chain supports the scanning of Java projects built using Maven or Gradle Wrapper **without the need for lockfiles**. Learn more about [scanning your project without generating a Maven dependency tree](/docs/semgrep-supply-chain/getting-started#scan-a-project-without-lockfiles-beta).

Semgrep Supply Chain does not read `pom.xml` files to parse Maven projects. Instead it parses a dependency tree generated by Maven (`mvn`).

The **general steps** to enable Semgrep Supply Chain to correctly parse Maven projects are as follows:

- Generate a file outlining the project&#x27;s dependency tree by adding the following command to your build pipeline:
mvn dependency:tree -DoutputFile=maven_dep_tree.txt
For specific steps to add the command into your build pipeline, refer to your CI provider&#x27;s documentation.- For each `pom.xml` file with dependencies you want to scan, create additional dependency trees in their respective directories. Semgrep Supply Chain can detect and parse them all.- Run the Semgrep workflow, action, or step after the dependency tree or trees have been generated.
caution
- Ensure that Maven is installed in the build environment that is used to generate the dependency trees.
- Ensure that you generate dependency trees before running Semgrep.
- This approach works for full scans. It does not work for [diff-aware scans](/docs/deployment/customize-ci-jobs#set-up-diff-aware-scans) because the generated file is not tracked by Git.

You can perform the general steps in a local environment for testing. The following screenshot displays the commands running in a local environment:

## Scanning Apache Maven projects with specific CI providers[​](#scanning-apache-maven-projects-with-specific-ci-providers)
This section describes steps to set up Apache Maven with specific CI providers.

## GitHub Actions[​](#github-actions)
To successfully run a Semgrep Supply Chain scan in GitHub Actions, the GitHub Actions workflow must generate all dependency trees in one job and then run Semgrep after.

### Sample GitHub Actions Maven workflow[​](#sample-github-actions-maven-workflow)
- Multiple pom.xml files- Single pom.xml fileIn the following code snippet, dependency trees are shared between the two jobs through a zip file that gathers all the lockfiles and, in the next job, unzips the lockfiles and runs Semgrep as usual.

`on:  workflow_dispatch:  pull_request: {}  push:    branches:    - master    paths:    - .github/workflows/semgrep.ymlname: Semgrepjobs:  buildmavenDepTree:      runs-on: ubuntu-latest      steps:      - uses: actions/checkout@v4      - name: Set up JDK 11        uses: actions/setup-java@v3        with:          java-version: &#x27;11&#x27;          distribution: &#x27;temurin&#x27;      - name: Build Dependency Tree        # The mvn command traverses the repository and generates a dependency tree for each pom.xml file        run: mvn dependency:tree -DoutputFile=maven_dep_tree.txt -Dmaven.test.skip=true      - name: Create Zip File        run: find . -type f -name &#x27;maven_dep_tree.txt&#x27; -exec zip -r archive.zip {} +      - name: Upload Dependency Zip        uses: actions/upload-artifact@v3        with:          name: zipfile          path: archive.zip  semgrep:    needs: buildmavenDepTree    name: Scan    runs-on: ubuntu-latest    env:      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}    container:      image: semgrep/semgrep    steps:      - uses: actions/checkout@v4      - name: Download artifact from the previous job        uses: actions/download-artifact@v3        with:          name: zipfile      - name: Semgrep Scan        run: |          unzip -o archive.zip          semgrep ci`The following code snippet is intended for repositories with a single `pom.xml` file.

`on:  workflow_dispatch:  pull_request: {}  push:    branches:    - main    paths:    - .github/workflows/semgrep.ymlname: Semgrepjobs:  buildmavenDepTree:      runs-on: ubuntu-latest      steps:      - uses: actions/checkout@v4      - name: Set up JDK 17        uses: actions/setup-java@v3        with:          java-version: &#x27;17&#x27;          distribution: &#x27;temurin&#x27;      - name: Build with Maven        run: mvn --batch-mode --update-snapshots package      - name: Build Dependency Tree        run: mvn dependency:tree -DoutputFile=maven_dep_tree.txt      - name: Upload Dependency Tree Artifact        uses: actions/upload-artifact@v3        with:          name: mavendeptree          path: maven_dep_tree.txt  semgrep:    needs: buildmavenDepTree    name: Scan    runs-on: ubuntu-latest    env:      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}    container:      image: semgrep/semgrep    steps:      - uses: actions/checkout@v4      - name: Download artifact from previous job        uses: actions/download-artifact@v3        with:          name: mavendeptree      - run: semgrep ci`
To **request support for your CI provider**, join the [Semgrep Community Slack](https://go.semgrep.dev/slack)  group to ask the maintainers and the community.

Not finding what you need in this doc? Ask questions in our [Community Slack group](https://go.semgrep.dev/slack), or see [Support](/docs/support/) for other ways to get help.

Tags:**- [Deployment](/docs/tags/deployment)- [Semgrep Supply Chain](/docs/tags/semgrep-supply-chain)[Edit this page](https://github.com/semgrep/semgrep-docs/edit/main/docs/semgrep-supply-chain/setup-maven.md)Last updated on **Apr 3, 2025**