CycloneDX / CycloneDX/cyclonedx-maven-plugin
exclude dependencies with other goals than makeAggregateBom
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
I'm having a hard time excluding specific dependencies.
In our project, we need to use the makeBom goal, because it is a multi-module project and we just want to build specific modules.
When we use makeAggregateBom, the whole Project build for every module included, thus we use makeBom as a goal.
Now we need to exclude specific dependencies. Sadly it seems like it does only work with the makeAggregateBom goal. I tried the excludeArtifactId option as a parameter when calling and as a configuration in the maven file.
I found a TODO [here](https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/9689d39795800b025f9c17edc677ffd32d8a63ea/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java#L283).
I also tried multiple versions btw. (2.6.x, 2.7.0 and 2.7.4)
Contributor guide
Research direction
Start in src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java at the TODO around line 283, then compare how exclusions work for makeAggregateBom with makeBom. Use the Maven configuration and the reported excludeArtifactId behavior as the reproduction case; done means exclusions work when makeBom is used without changing aggregate generation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100