aboutcode-org / aboutcode-org/scancode-toolkit

packagecode: gradle nebula dependency lock parser

Open
#2,761 6 comments 1 reaction 0 assignees View on GitHub
dependencies new feature package scan
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

## Short Description

gradle is a build tool for the ajva ecosystem especially popular in android apps.

nebula gradle dependency lock allows developer to lock their gradle dependencies and sub dependencies to specific versions
packagecode should be able to parse this simple information

## Possible Labels

- new feature
- package scan

## Select Category

- [ ] Enhancement
- [ ] Add License/Copyright
- [x] Scan Feature
- [ ] Packaging
- [ ] Documentation
- [ ] Expand Support
- [ ] Other

## **Describe the Update**

lock format is documented here:

https://github.com/nebula-plugins/gradle-dependency-lock-plugin/wiki/Usage#lock-file-format

It is a simple json format that clearly shows the packages and versions.
Should be quite easy to parse

## **How This Feature will help you/your organization**

This will have using scancode to extract our gradle dependencies.

## **Possible Solution/Implementation Details**

## **Example/Links if Any**

## **Can you help with this Feature**

Renault will probably contribute this feature in the next month

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.