When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info.
Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase.
The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.
To Reproduce
Include a dependency with 'runtimeOnly' dependency configuration in the build.gradle file.
Build the project.
Publish to Artifactory using the command ./gradlew artifactoryPublish
See the build-info missing the dependency specified in the 'runtimeOnly' configuration.
Expected behavior
The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.
Describe the bug
When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info. Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase. The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.
To Reproduce
Expected behavior
The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.
Screenshots
Versions
Additional context None.