Deprioritize the parsing of gradle dependencies in favor of always running the gradle plugin

[azabujuban]

Apologies if this was considered previously. Right now, when running cdxgen cli it detects gradle projects, runs the gradle dependencies task and parses the output.

However, there is also the gradle plugin which uses the gradle API to gather the dependencies and generate BOM out of them.

Is there any reason not to use a gradle init script with the cdxgen dependency and just let it generate the BOM? Basically similar to maven.

[prabhu]

Are you facing any issues, where the gradle plugin works better compared to cdxgen? Instead of making cdxgen a kitchen sink, all these logic can be scripted out externally with cdxgen invoked only with specific type arguments.

[azabujuban]

I don't have any specific issues. And I apologize if this proposal makes no sense.

There are several reasons for the proposal:

• Conceptually, it seems that the build tool that deals with the dependencies already should be able to generate the BOM - it already has all of the necessary information.

• There is an option in cdxgen to either use a maven plugin or dependencies output. So I assumed that same could be done in gradle (especially since the default is set to use the plugin).

• cdxgen is really good at "orchestrating" the BOM generation (especially the containerized version with everything necessary pre-installed). So I thought that it could continue doing it while letting the plugins generate the BOM for each project. In the end, something needs to merge the BOMs and cdxgen seems to be the best place to do it.

[prabhu]

I see the appeal. I always thought the maven plugin to be an exception. Let me think about the gradle plugin proposal a bit more. Thank you for the suggestion!