Skip to content

fix: problem with gradle version resolution#141

Merged
soul2zimate merged 1 commit into
guacsec:mainfrom
soul2zimate:gradle_resolution_main
Jun 18, 2025
Merged

fix: problem with gradle version resolution#141
soul2zimate merged 1 commit into
guacsec:mainfrom
soul2zimate:gradle_resolution_main

Conversation

@soul2zimate

@soul2zimate soul2zimate commented Jun 16, 2025

Copy link
Copy Markdown
Contributor

Description

Refactor how the Gradle dependencies are resolved because as the full tree is available in both component and stack analysis we can use the right trees instead of just the api / implementation listings. This helps resolving the correct versions.

With that it is also possible to include the correct scope (required / optional) to the sbom

Related issue (if any):

Checklist

  • I have followed this repository's contributing guidelines.
  • I will adhere to the project's code of conduct.

Additional information

Anything else?

cc @olavtar @zvigrinberg in case you have some free time to review 😄 Thanks.

@soul2zimate soul2zimate requested a review from ruromero June 16, 2025 02:13

@ruromero ruromero left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mind reviewing my comments? Thanks

Comment thread src/test/java/com/redhat/exhort/providers/Gradle_Provider_Test.java Outdated
Comment thread src/main/java/com/redhat/exhort/providers/BaseJavaProvider.java Outdated
Comment thread src/main/java/com/redhat/exhort/providers/JavaMavenProvider.java

@ruromero ruromero left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall looks good

Comment thread src/main/java/com/redhat/exhort/providers/GradleProvider.java Outdated
Comment thread src/main/java/com/redhat/exhort/providers/JavaMavenProvider.java

@ruromero ruromero left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

Signed-off-by: Chao Wang <chaowan@redhat.com>
@soul2zimate soul2zimate force-pushed the gradle_resolution_main branch from 1a41c6c to 4e13f06 Compare June 16, 2025 11:28
@soul2zimate soul2zimate merged commit e53b921 into guacsec:main Jun 18, 2025
3 checks passed
@soul2zimate soul2zimate deleted the gradle_resolution_main branch June 18, 2025 02:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Gradle component version resolution Add scope to Gradle SBOM Gradle stack analysis scans FAILED dependencies

2 participants