Running cdxgen tool on gradle project failed with error

[MohammedAziz02]

I'm trying to execute the cdxgen tool on a gradle project and include only runTime and compile dependencies on : this one, I used the command : cdxgen -t gradle -o BOM.json --spec-version 1.4 --fail-on-error with env variable like this GRADLE_ARGS="--configuration runtimeClassPath",
but it's failed with the error :
Executing /gradlew properties -q --console plain --build-cache --configuration runtimeClassPath in .
project okafka client lib

FAILURE: Build failed with an exception.

• What went wrong:
  Problem configuring task :properties from command line.

Unknown command-line option '--configuration'.

• Try:

Run gradlew help --task :properties to get task usage details.
Run with --stacktrace option to get the stack trace.
Run with --info or --debug option to get more log output.
Run with --scan to get full insights.

• Get more help at https://help.gradle.org

BUILD FAILED in 228ms

1. Check if the correct version of java and gradle are installed and available in PATH. For example, some project might require Java 11 with gradle 7.
   cdxgen container image bundles Java 21 with gradle 8 which might be incompatible.
2. Try running cdxgen with the unofficial JDK11-based image ghcr.io/appthreat/cdxgen-java:v10.
   Executing /gradlew dependencies -q --console plain --build-cache --configuration runtimeClassPath in .
   project okafka client lib

FAILURE: Build failed with an exception.

• What went wrong:
  Configuration 'runtimeClassPath' not found in configuration container.

• Try:

Run with --stacktrace option to get the stack trace.
Run with --info or --debug option to get more log output.
Run with --scan to get full insights.

• Get more help at https://help.gradle.org

[prabhu]

@MohammedAziz02 Can you get some help from gradle experts? Doesn't look like a cdxgen bug.

[MohammedAziz02]

@prabhu, ah okey thank you, but is add GRADLE_ARGS="--configuration runtimeClassPath" as an env variable is the best way to include only the runtime dependencies in the sbom result ?

[prabhu]

Depends on what you're trying to achieve. Are you trying to generate a post-build SBOM with only the components that might get deployed? runtime means those components offered by the runtime classpath configuration such as the OS or the container image or the app server.

[MohammedAziz02]

yes, actually i'm trying to generate a sbom for a gradle project with only the compile and the runtime components using cdxgen CLI. so I need to add GRADLE_ARGS="--configuration runtimeClassPath --configuration compile"?, thank you in advance

[prabhu]

Try running the gradle commands directly to see if it does what you expect. Then those arguments could be passed via GRADLE_ARGS.