CycloneDX / CycloneDX/cyclonedx-gradle-plugin

Gradle plugin is not generating "scope" field in SBOM

Open
#679 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
240
Forks
103
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Is it intentional that the plugin is not able to generate a "scope" field for the component from the dependencies?

For example:

```
dependencies {
testImplementation("com.google.guava:guava:33.4.8-jre")
implementation 'com.google.code.gson:gson:2.13.2'
}
```

i expect something like:
```
"scope" : "required",
...
"scope" : "optional",
```

If it is not possible to automatically link the implementation/testImplementation to the required/optional ones, will it be possible to map these properties manually in the future?

Contributor guide

Open the contributing guide

Research direction

Reproduce the example in a Gradle project using testImplementation and implementation dependencies, then inspect the generated SBOM to confirm that component scope is absent. Determine whether the plugin can derive required and optional scopes from these configurations or whether a manual mapping is needed; done means the generated components contain the expected scope values.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.