CycloneDX / CycloneDX/cyclonedx-gradle-plugin
Gradle plugin is not generating "scope" field in SBOM
- Dominant language
- Java
- Stars
- 240
- Forks
- 103
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
Is it intentional that the plugin is not able to generate a "scope" field for the component from the dependencies?
For example:
```
dependencies {
testImplementation("com.google.guava:guava:33.4.8-jre")
implementation 'com.google.code.gson:gson:2.13.2'
}
```
i expect something like:
```
"scope" : "required",
...
"scope" : "optional",
```
If it is not possible to automatically link the implementation/testImplementation to the required/optional ones, will it be possible to map these properties manually in the future?
Contributor guide
Research direction
Reproduce the example in a Gradle project using testImplementation and implementation dependencies, then inspect the generated SBOM to confirm that component scope is absent. Determine whether the plugin can derive required and optional scopes from these configurations or whether a manual mapping is needed; done means the generated components contain the expected scope values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100