@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/ecosystems/gradleutils.js

@@ -31,6 +31,7 @@ import {
 } from "../inventory/buildToolRateLimit.js";
 import { collectJarNS } from "../inventory/deps.js";
 import { minimumGradleVersionForJava } from "../inventory/jvmToolEnv.js";
+import { gradleMirrorInitScriptArgs } from "../inventory/mavenCentralMirror.js";
 import { applyPurl, tryBuildPurl } from "../inventory/purl.js";
 import { parsePkgJson } from "./parsers-js.js";
 
@@ -218,6 +219,50 @@ function gradleEvaluationOverrides(gradleArguments) {
   return overrides;
 }
 
+/**
+ * Keep Gradle's task headers in the output. cdxgen splits the `properties`
+ * and `dependencies` reports by the `> Task :path` headers, which Gradle
+ * prints at the lifecycle log level, so a project that sets
+ * `org.gradle.logging.level=quiet` or `warn` in `gradle.properties` would
+ * leave nothing to split. A command-line `-D` property beats
+ * `gradle.properties`, and a log-level option such as `--info` beats the
+ * property. A log level the user chose in `GRADLE_ARGS` is left alone.
+ *
+ * @param {string[]} gradleArguments User-supplied general gradle arguments
+ * @returns {string[]} The `-D` flag to inject, or nothing
+ */
+function gradleLogLevelOverride(gradleArguments) {
+  const logLevelOptions = [
+    "-q",
+    "--quiet",
+    "-w",
+    "--warn",
+    "-i",
+    "--info",
+    "-d",
+    "--debug",
+  ];
+  const userChose = gradleArguments.some(
+    (arg) =>
+      logLevelOptions.includes(arg) ||
+      arg.startsWith("-Dorg.gradle.logging.level="),
+  );
+  return userChose ? [] : ["-Dorg.gradle.logging.level=lifecycle"];
+}
+
+/**
+ * Read a whitespace-separated list of Gradle arguments from an environment
+ * variable such as `GRADLE_ARGS`. Repeated, leading or trailing whitespace
+ * adds no empty argument, which Gradle would read as a task path.
+ *
+ * @param {string} name Name of the environment variable
+ * @returns {string[]} The arguments, empty when the variable is unset
+ */
+export function gradleArgsFromEnv(name) {
+  const value = readEnvironmentVariable(name);
+  return value ? value.split(/\s+/).filter(Boolean) : [];
+}
+
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -242,6 +287,8 @@ export function buildGradleCommandArguments(
   ]
     .concat(getGradleDaemonParameter())
     .concat(gradleEvaluationOverrides(gradleArguments))
+    .concat(gradleLogLevelOverride(gradleArguments))
+    .concat(gradleMirrorInitScriptArgs())
     .concat(gradleArguments);
   const maxCliArgsLength = isWin
     ? 7500 - gradleCommandLength - mainGradleArguments.join(" ").length - 2
@@ -257,7 +304,13 @@ export function buildGradleCommandArguments(
   for (const gradleSubCommand of gradleSubCommands) {
     const subCommandLength =
       [gradleSubCommand, ...gradleSubCommandArguments].join(" ").length + 1;
-    if (maxCliArgsLength !== -1 && remainingLength - subCommandLength < 0) {
+    // An invocation always carries at least one task: without one Gradle
+    // runs the project's default tasks.
+    if (
+      maxCliArgsLength !== -1 &&
+      remainingLength - subCommandLength < 0 &&
+      allGradleArguments.length > mainGradleArguments.length
+    ) {
       splitArgs.push(allGradleArguments);
       allGradleArguments = [].concat(mainGradleArguments);
       remainingLength = maxCliArgsLength;
@@ -297,16 +350,52 @@ function parseGradleTaskHeader(line) {
   if (!line.startsWith("> Task :")) {
     return undefined;
   }
-  // The path is the first token: a status such as UP-TO-DATE or FAILED may
-  // follow it, and a CRLF line keeps its carriage return.
-  const taskPath = line.slice("> Task ".length).trim().split(/\s+/)[0];
+  // A project path may contain spaces (`:my lib`), and a status such as
+  // UP-TO-DATE or FAILED may follow the task name, so the task name is the
+  // first token after the last colon. A status never contains a colon, and a
+  // CRLF line keeps its carriage return.
+  const taskPath = line.slice("> Task ".length).trim();
   const lastColon = taskPath.lastIndexOf(":");
   return {
     projectPath: taskPath.slice(0, lastColon),
-    taskName: taskPath.slice(lastColon + 1),
+    taskName: taskPath.slice(lastColon + 1).split(/\s+/)[0],
   };
 }
 
+/**
+ * List the dependency tasks to run for the root project and every module read
+ * from `gradle properties`.
+ *
+ * The root project is recognised by identity, never by purl. A module named
+ * after the root project that inherits its group and version has the root's
+ * purl (issue 4695), and it still needs its own `:module:dependencies` task.
+ * `root` in `modulesToSkip` drops the root task; any other entry is a module
+ * path.
+ *
+ * @param {Map<string, Object>} gradleModules Modules keyed by project path, and the root project by its name
+ * @param {Object} rootComponent The component built for the root project
+ * @param {string} gradleDepTask Name of the dependency task, usually `dependencies`
+ * @param {string[]} modulesToSkip Module paths, or `root`, to leave out
+ * @returns {string[]} Task paths in the order Gradle should run them
+ */
+export function gradleDependencyTasks(
+  gradleModules,
+  rootComponent,
+  gradleDepTask,
+  modulesToSkip = [],
+) {
+  const tasks = [];
+  if (!modulesToSkip.includes("root")) {
+    tasks.push(gradleDepTask);
+  }
+  for (const [key, module] of gradleModules) {
+    if (module !== rootComponent && !modulesToSkip.includes(key)) {
+      tasks.push(`${key}:${gradleDepTask}`);
+    }
+  }
+  return tasks;
+}
+
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
@@ -398,27 +487,19 @@ export function parseGradleProjects(rawOutput) {
             }
           }
         }
-      } else if (l.includes("--- project ")) {
-        const tmpB = l.split("--- project ");
-        if (tmpB && tmpB.length > 1) {
-          const projName = tmpB[1];
-          if (projName.startsWith(":")) {
-            const tmpName = projName.split(" ")[0];
-            if (tmpName.length > 1) {
-              projects.add(tmpName);
-            }
+      } else {
+        for (const marker of ["--- project ", "-> project "]) {
+          const markerIndex = l.indexOf(marker);
+          if (markerIndex === -1) {
+            continue;
           }
-        }
-      } else if (l.includes("-> project ")) {
-        const tmpB = l.split("-> project ");
-        if (tmpB && tmpB.length > 1) {
-          const projName = tmpB[1];
-          if (projName.startsWith(":")) {
-            const tmpName = projName.split(" ")[0];
-            if (tmpName.length > 1) {
-              projects.add(tmpName);
-            }
+          const projName = gradleProjectPath(
+            l.slice(markerIndex + marker.length),
+          );
+          if (projName?.startsWith(":") && projName.length > 1) {
+            projects.add(projName);
           }
+          break;
         }
       }
     });
@@ -432,11 +513,17 @@ export function parseGradleProjects(rawOutput) {
 /**
  * Parse gradle properties output
  *
+ * `gradlePlugin` is true when the project has the `gradlePlugin` extension,
+ * which `java-gradle-plugin`, `kotlin-dsl` and `groovy-gradle-plugin` add: the
+ * project builds Gradle plugins, as a `build-logic` build does.
+ *
  * @param {string} rawOutput Raw string output
  * @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
+ * @returns {{rootProject: string, projects: string[], metadata: Object, gradlePlugin: boolean}} The parsed properties
  */
 export function parseGradleProperties(rawOutput, gradleModuleName = null) {
   let rootProject = "root";
+  let gradlePlugin = false;
   const projects = new Set();
   const metadata = { group: "", version: "latest", properties: [] };
   if (gradleModuleName) {
@@ -472,6 +559,8 @@ export function parseGradleProperties(rawOutput, gradleModuleName = null) {
           metadata[tmpB[0]] = tmpB[1].trim().replace("unspecified", "latest");
         } else if (["buildFile", "projectDir", "rootDir"].includes(tmpB[0])) {
           metadata.properties.push({ name: tmpB[0], value: tmpB[1].trim() });
+        } else if (tmpB[0] === "gradlePlugin") {
+          gradlePlugin = true;
         } else if (tmpB[0] === "subprojects") {
           const spStrs = tmpB[1].replace(/[[\]']/g, "").split(", ");
           const tmpprojects = spStrs
@@ -486,6 +575,7 @@ export function parseGradleProperties(rawOutput, gradleModuleName = null) {
     rootProject,
     projects: Array.from(projects),
     metadata,
+    gradlePlugin,
   };
 }
 
@@ -511,17 +601,11 @@ export function executeParallelGradleProperties(
   }
   const gradleCmd = getGradleCommand(dir, null, options);
   const gradleArgs = buildGradleCommandArguments(
-    extraArgs.concat(
-      readEnvironmentVariable("GRADLE_ARGS")
-        ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
-        : [],
-    ),
+    extraArgs.concat(gradleArgsFromEnv("GRADLE_ARGS")),
     allProjectsStr.map((project) =>
       project ? `${project}:properties` : "properties",
     ),
-    readEnvironmentVariable("GRADLE_ARGS_PROPERTIES")
-      ? readEnvironmentVariable("GRADLE_ARGS_PROPERTIES").split(" ")
-      : [],
+    gradleArgsFromEnv("GRADLE_ARGS_PROPERTIES"),
     gradleCmd.length,
   );
   const allOutputs = [];
@@ -880,19 +964,526 @@ export function recordGradleInvocationFailure(result, context = {}) {
   });
 }
 
+/**
+ * Configurations whose dependencies never reach the packaged application:
+ * code-quality tools, coverage agents and Spring Boot's development-only
+ * dependencies.
+ */
+const GRADLE_TOOL_CONFIGURATIONS = new Set([
+  "checkstyle",
+  "codenarc",
+  "detekt",
+  "developmentOnly",
+  "errorprone",
+  "jacocoAgent",
+  "jacocoAnt",
+  "ktlint",
+  "lintChecks",
+  "lintClassPath",
+  "pmd",
+  "spotbugs",
+  "spotbugsPlugins",
+]);
+
+/**
+ * Parts of a configuration name that mark it as feeding the compiler or a
+ * build tool, such as `annotationProcessor`, Android's
+ * `debugAnnotationProcessorClasspath` or `kotlinCompilerPluginClasspathMain`.
+ */
+const GRADLE_TOOL_CONFIGURATION_PARTS = [
+  "annotationprocessor",
+  "buildtoolsapiclasspath",
+  "commonizer",
+  "compilerclasspath",
+  "compilerpluginclasspath",
+];
+
+/**
+ * Properties that describe a dependency Gradle could not resolve.
+ */
+const GRADLE_FAILURE_PROPERTIES = [
+  "cdx:gradle:resolutionFailed",
+  "cdx:gradle:requestedVersion",
+];
+
+/**
+ * Markers Gradle appends to a dependency tree line, with the flag each sets.
+ */
+const GRADLE_TREE_LINE_MARKERS = [
+  ["(*)", "omitted"],
+  ["(c)", "constraint"],
+  ["(n)", "unresolvable"],
+  ["FAILED", "failed"],
+];
+
+/**
+ * Read the name of the configuration a `gradle dependencies` header line
+ * introduces, such as `runtimeClasspath - Runtime classpath of source set
+ * 'main'.`, `api (n)`, a bare `classpath`, a Groovy name such as
+ * `integration-test` or an internal one such as
+ * `_internal-unified-test-platform-android-device-provider-ddmlib`.
+ *
+ * @param {string} line One line of the report
+ * @returns {string|undefined} The configuration name, or undefined when the
+ *   line is not a configuration header
+ */
+function parseGradleConfigurationHeader(line) {
+  let name = line.split(" - ")[0];
+  if (name.endsWith(" (n)")) {
+    name = name.slice(0, -" (n)".length);
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) ? name : undefined;
+}
+
+/**
+ * Configurations, other than runtime classpaths, whose dependencies ship
+ * with the application: `compile` and `default` in Gradle 6 and older, which
+ * the runtime classpath extended, and the Shadow plugin's `shadow`, whose
+ * dependencies the published artifact declares as runtime dependencies.
+ */
+const GRADLE_SHIPPED_CONFIGURATIONS = new Set(["compile", "default", "shadow"]);
+
+/**
+ * Map a Gradle configuration to the CycloneDX scope of the dependencies it
+ * resolves, so that only what ships with the application reads as required.
+ *
+ * Configurations whose name starts with `_`, such as the Android Gradle
+ * plugin's `_internal-unified-test-platform-*` ones, are the plugin's own
+ * tooling and `excluded`. Test configurations are `optional`. Runtime
+ * classpaths, including Android
+ * variants such as `debugRuntimeClasspath` and Kotlin targets such as
+ * `jvmRuntimeClasspath`, are `required`, and so are Kotlin/Native klibraries,
+ * which are linked into the binary, and the configurations in
+ * `GRADLE_SHIPPED_CONFIGURATIONS`. Everything else is `excluded`: annotation
+ * processors, compiler, code-quality and other build-tool classpaths, and
+ * compile classpaths, whose dependencies a runtime classpath also lists unless
+ * they are compile-only, as Maven's `provided` scope is. A dependency seen in
+ * several configurations keeps the strongest scope among them. Test and
+ * runtime are matched as whole words of the camel-case name, so
+ * `latestRuntimeClasspath` is a runtime classpath, not a test one.
+ *
+ * @param {string} configurationName Name of the configuration
+ * @returns {string} The CycloneDX scope
+ */
+function gradleConfigurationScope(configurationName) {
+  const lowerName = configurationName.toLowerCase();
+  const words = configurationName
+    .split(/[-_.]|(?=[A-Z])/)
+    .map((word) => word.toLowerCase());
+  if (
+    GRADLE_TOOL_CONFIGURATIONS.has(configurationName) ||
+    configurationName.startsWith("_") ||
+    ["kapt", "ksp"].includes(words[0]) ||
+    GRADLE_TOOL_CONFIGURATION_PARTS.some((part) => lowerName.includes(part))
+  ) {
+    return "excluded";
+  }
+  if (words.includes("test") || words.includes("tests")) {
+    return "optional";
+  }
+  if (
+    words.includes("runtime") ||
+    words.includes("klibraries") ||
+    GRADLE_SHIPPED_CONFIGURATIONS.has(configurationName)
+  ) {
+    return "required";
+  }
+  return "excluded";
+}
+
+/**
+ * Rank a scope so that a dependency seen in several configurations keeps the
+ * strongest one: `required` or no scope (which CycloneDX reads as required),
+ * then `optional`, then `excluded`.
+ *
+ * @param {string|undefined} scope CycloneDX scope
+ * @returns {number} The rank, higher being stronger
+ */
+function gradleScopeRank(scope) {
+  if (scope === "required" || scope === undefined) {
+    return 2;
+  }
+  return scope === "optional" ? 1 : 0;
+}
+
+/**
+ * Read a project path from the text that follows `project ` in a dependency
+ * tree line. Gradle 9 quotes the path (`project ':lib'`), Gradle 8 does not
+ * (`project :lib`).
+ *
+ * @param {string} text The text after `project `
+ * @returns {string|undefined} The project path, such as `:lib`
+ */
+function gradleProjectPath(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("'")) {
+    const end = trimmed.indexOf("'", 1);
+    return end > 1 ? trimmed.slice(1, end) : undefined;
+  }
+  return trimmed.split(" ")[0] || undefined;
+}
+
+/**
+ * Find the module a project path in a dependency tree names. Subprojects are
+ * keyed by their path (`:lib`) and the root project by its name, so the root
+ * path `:` resolves to the report's own project when that is the root, or else
+ * to the one module keyed by a name.
+ *
+ * @param {Map} gradleModules Modules keyed by project path or root name
+ * @param {string} projectPath Project path from the tree, such as `:lib` or `:`
+ * @param {string} reportProjectName Key of the project the report belongs to
+ * @returns {Object|undefined} The module component
+ */
+function gradleModuleForPath(gradleModules, projectPath, reportProjectName) {
+  if (projectPath !== ":") {
+    return gradleModules.get(projectPath);
+  }
+  if (!reportProjectName.startsWith(":")) {
+    return gradleModules.get(reportProjectName);
+  }
+  const rootKeys = [...gradleModules.keys()].filter((k) => !k.startsWith(":"));
+  return rootKeys.length === 1 ? gradleModules.get(rootKeys[0]) : undefined;
+}
+
+/**
+ * Pick a concrete version out of the version Gradle printed as requested. A
+ * rich version such as `{strictly 1.0}`, `{require 2.2; reject 2.0}` or
+ * `{prefer 2.0.9}` gives the version of its first strictly, require or prefer
+ * clause. A range or dynamic version gives none.
+ *
+ * @param {string|undefined} versionText The requested version
+ * @returns {string|undefined} The concrete version
+ */
+function gradleRequestedVersion(versionText) {
+  if (!versionText) {
+    return undefined;
+  }
+  // `1.+` and `latest.release` are dynamic and a bracketed range is a
+  // range, but `0.92.2+1.20.1` is a concrete version with build metadata.
+  const isConcrete = (v) =>
+    v &&
+    !v.endsWith("+") &&
+    !v.startsWith("latest.") &&
+    ![..."[](),"].some((ch) => v.includes(ch));
+  if (!versionText.startsWith("{")) {
+    return isConcrete(versionText) ? versionText : undefined;
+  }
+  const body = versionText.slice(1, versionText.lastIndexOf("}"));
+  for (const clause of body.split(";")) {
+    const [keyword, ...rest] = clause.trim().split(" ");
+    const value = rest.join(" ").trim();
+    if (
+      ["strictly", "require", "prefer"].includes(keyword) &&
+      isConcrete(value)
+    ) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Split one line of a `gradle dependencies` tree into its depth and the
+ * dependency it names. The selected side of `->` wins over the requested
+ * side, whether it is a version, other coordinates or a project.
+ *
+ * @param {string} line One line of the report, without its line ending
+ * @returns {Object|undefined} `{ level, group, name, version,
+ *   requestedVersion, projectPath, omitted, constraint, unresolvable, failed }`,
+ *   `{ level, unknown: true }` for a tree line whose dependency cannot be
+ *   read, or undefined when the line is not a tree line
+ */
+function parseGradleTreeLine(line) {
+  const markerIndex = line.indexOf("--- ");
+  if (markerIndex < 1) {
+    return undefined;
+  }
+  for (const ch of line.slice(0, markerIndex)) {
+    if (!"|+\\ ".includes(ch)) {
+      return undefined;
+    }
+  }
+  const parsed = {
+    level: Math.floor(markerIndex / 5) + 1,
+    omitted: false,
+    constraint: false,
+    unresolvable: false,
+    failed: false,
+  };
+  let text = line.slice(markerIndex + "--- ".length).trim();
+  let stripped = true;
+  while (stripped) {
+    stripped = false;
+    for (const [marker, flag] of GRADLE_TREE_LINE_MARKERS) {
+      if (text.endsWith(` ${marker}`)) {
+        parsed[flag] = true;
+        text = text.slice(0, -marker.length - 1).trimEnd();
+        stripped = true;
+      }
+    }
+  }
+  const [requested, selected] = text.split(" -> ");
+  if (requested.startsWith("project ")) {
+    parsed.projectPath = gradleProjectPath(requested.slice("project ".length));
+  } else {
+    const [group, name, ...versionParts] = requested.split(":");
+    if (!group || !name || group.includes(" ") || name.includes(" ")) {
+      return { level: parsed.level, unknown: true };
+    }
+    parsed.group = group;
+    parsed.name = name;
+    parsed.requestedVersion = versionParts.join(":") || undefined;
+    parsed.version = gradleRequestedVersion(parsed.requestedVersion);
+  }
+  if (selected?.startsWith("project ")) {
+    parsed.projectPath = gradleProjectPath(selected.slice("project ".length));
+  } else if (selected?.includes(":")) {
+    // The selected module replaces the requested one, version and all.
+    const [group, name, version] = selected.split(":");
+    parsed.group = group;
+    parsed.name = name;
+    parsed.version = version;
+    parsed.requestedVersion = undefined;
+  } else if (selected) {
+    parsed.version = selected;
+  }
+  if (parsed.projectPath === undefined && !parsed.group) {
+    return { level: parsed.level, unknown: true };
+  }
+  return parsed;
+}
+
+/**
+ * Read the properties of every project the dependency reports name that
+ * `gradleModules` does not have yet, such as a project of an included build,
+ * and add a module for each one whose properties task printed a report. One
+ * Gradle invocation covers all of them.
+ *
+ * @param {Iterable<string>} reports Text of the `gradle dependencies` reports
+ * @param {Map} gradleModules Modules keyed by project path, updated in place
+ * @param {string} gradleRootPath Directory to run Gradle in
+ * @param {Object} options CLI options
+ * @returns {Promise<string[]>} Paths of the projects added
+ */
+export async function loadGradleModulesForReports(
+  reports,
+  gradleModules,
+  gradleRootPath,
+  options = {},
+) {
+  const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+    ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+    : [];
+  const missing = new Set();
+  for (const report of reports) {
+    for (const projectPath of parseGradleProjects(report).projects) {
+      if (
+        !gradleModules.has(projectPath) &&
+        !modulesToSkip.includes(projectPath)
+      ) {
+        missing.add(projectPath);
+      }
+    }
+  }
+  if (!missing.size || !isProjectToolingAllowed(options)) {
+    return [];
+  }
+  const splitPropTaskOut = splitOutputByGradleProjects(
+    executeParallelGradleProperties(gradleRootPath, [...missing], [], options),
+    ["properties"],
+  );
+  const added = [];
+  for (const projectPath of missing) {
+    // A project whose properties task printed nothing has no metadata to
+    // build a module from.
+    if (!splitPropTaskOut.has(projectPath)) {
+      continue;
+    }
+    const propMap = parseGradleProperties(
+      splitPropTaskOut.get(projectPath),
+      projectPath,
+    );
+    gradleModules.set(
+      projectPath,
+      await buildObjectForGradleModule(
+        propMap.rootProject === "root"
+          ? projectPath.split(":").pop()
+          : propMap.rootProject,
+        propMap.metadata,
+      ),
+    );
+    added.push(projectPath);
+  }
+  return added;
+}
+
+/**
+ * Give the components of a build-tooling report, such as that of an included
+ * build that builds Gradle plugins, the `excluded` scope that build-tool
+ * configurations get. `reconcileGradleComponents` later keeps a stronger
+ * scope that another project's report gives the same component.
+ *
+ * @param {Object[]} pkgList Components from one project's report, updated in place
+ * @param {Map<string, Object>} gradleModules Modules, which keep their own scope
+ * @returns {Object[]} The same list
+ */
+export function excludeGradleBuildTooling(pkgList, gradleModules) {
+  const modules = new Set(gradleModules.values());
+  for (const pkg of pkgList) {
+    if (!modules.has(pkg)) {
+      pkg.scope = "excluded";
+    }
+  }
+  return pkgList;
+}
+
+/**
+ * Reconcile the copies of a component that several Gradle projects report.
+ * Every copy gets the strongest scope any project gave it, so a library one
+ * module only tests with stays required when another module compiles against
+ * it, and a dependency one project failed to resolve loses its failure
+ * properties when another project resolved it.
+ *
+ * @param {Object[]} pkgList Components from all the projects, updated in place
+ * @returns {Object[]} The same list
+ */
+export function reconcileGradleComponents(pkgList) {
+  const strongest = new Map();
+  const resolvedSomewhere = new Set();
+  const isFailed = (pkg) =>
+    pkg.properties?.some((p) => p.name === "cdx:gradle:resolutionFailed");
+  for (const pkg of pkgList) {
+    const key = pkg?.["bom-ref"];
+    if (!key) {
+      continue;
+    }
+    if (
+      !strongest.has(key) ||
+      gradleScopeRank(pkg.scope) > gradleScopeRank(strongest.get(key))
+    ) {
+      strongest.set(key, pkg.scope);
+    }
+    if (!isFailed(pkg)) {
+      resolvedSomewhere.add(key);
+    }
+  }
+  for (const pkg of pkgList) {
+    const key = pkg?.["bom-ref"];
+    if (!key) {
+      continue;
+    }
+    if (strongest.get(key) === undefined) {
+      delete pkg.scope;
+    } else {
+      pkg.scope = strongest.get(key);
+    }
+    if (resolvedSomewhere.has(key) && isFailed(pkg)) {
+      pkg.properties = pkg.properties.filter(
+        (p) => !GRADLE_FAILURE_PROPERTIES.includes(p.name),
+      );
+      if (!pkg.properties.length) {
+        delete pkg.properties;
+      }
+    }
+  }
+  return pkgList;
+}
+
+/**
+ * Whether a module name is one that platforms and BOMs use, such as
+ * `jackson-bom`, `spring-boot-dependencies`, `micronaut-platform` or the AWS
+ * SDK's `bom`.
+ *
+ * @param {string} name Module name
+ * @returns {boolean} True for a platform-style name
+ */
+function isGradlePlatformName(name) {
+  return (
+    name === "bom" ||
+    ["-bom", "-dependencies", "-platform"].some((suffix) =>
+      name.endsWith(suffix),
+    )
+  );
+}
+
+/**
+ * Give the platforms and BOMs in one report a `pom` type and the `excluded`
+ * scope. Gradle prints a platform like a library, with only constraints
+ * (`(c)`) under it, but a platform is a pom that never ships. A module counts
+ * as a platform when its name is one platforms use and the report gives it no
+ * dependency of its own, so a jar such as `jna-platform`, which depends on
+ * `jna`, stays a jar.
+ *
+ * @param {Map<string, {adep: Object, isModule: boolean}>} depsByRef Components of the report by bom-ref, updated in place
+ * @param {Object<string, string[]>} levelTrees Edges of the report by bom-ref
+ * @returns {Map<string, string>} The new bom-ref of each renamed component, keyed by its old one
+ */
+function markGradlePlatforms(depsByRef, levelTrees) {
+  const renamed = new Map();
+  for (const [bomRef, { adep, isModule }] of depsByRef) {
+    if (
+      isModule ||
+      adep.qualifiers?.type !== "jar" ||
+      !isGradlePlatformName(adep.name || "") ||
+      levelTrees[bomRef]?.length
+    ) {
+      continue;
+    }
+    const purl = tryBuildPurl({
+      type: "maven",
+      namespace: adep.group || null,
+      name: adep.name,
+      version: adep.version || null,
+      qualifiers: { type: "pom" },
+    });
+    if (!purl) {
+      continue;
+    }
+    adep.qualifiers = { type: "pom" };
+    adep.scope = "excluded";
+    applyPurl(adep, purl);
+    renamed.set(bomRef, adep["bom-ref"]);
+  }
+  return renamed;
+}
+
 /**
  * Method to resolve dependencies from a gradle output
  *
+ * A constraint line (`(c)`) adds neither a component nor an edge. Gradle
+ * prints a nested constraint under the platform or module that declares it,
+ * and only when the dependency it affects is resolved elsewhere in the tree,
+ * where that dependency gets its component and edges. A top-level
+ * `{strictly …}` constraint from consistent resolution can name a module the
+ * configuration never resolves. A dependency that failed to resolve carries
+ * `cdx:gradle:resolutionFailed`, keeps the version it was requested at when
+ * that is a concrete version, and otherwise records the request in
+ * `cdx:gradle:requestedVersion`. A dependency seen in several configurations
+ * keeps the strongest scope among them. Platforms and BOMs get a `pom` type
+ * and the `excluded` scope.
+ *
+ * The parser runs no Gradle task. A project the tree names but `gradleModules`
+ * lacks gets a component built from the root project's group and version; use
+ * `loadGradleModulesForReports` first to read such projects' properties.
+ *
+ * The lines Gradle prints under another project, such as `project ':lib'` in
+ * the report of `:app`, show that project's dependencies as `:app` resolved
+ * them, after conflict resolution. When `reportedProjects` names that project,
+ * its own report supplies its edges, so these lines add no edge from it.
+ *
  * @param {string} rawOutput Text output from gradle dependencies task
- * @param {string} rootProjectName Name of the root project
- * @param {map} gradleModules Cache with all gradle modules that have already been read
- * @param {string} gradleRootPath Root path where Gradle is to be run when getting module information
+ * @param {string} rootProjectName Key in `gradleModules` of the project the report belongs to
+ * @param {map} gradleModules Gradle modules keyed by project path, and the root project by its name
+ * @param {string} gradleRootPath Directory Gradle ran in, recorded as `cdx:gradle:GradleRootPath`
+ * @param {Set<string>} [reportedProjects] Keys in `gradleModules` of the projects whose own reports are parsed
+ * @returns {{pkgList: Object[], dependenciesList: Object[]}|{}} The components and dependency graph
  */
 export async function parseGradleDep(
   rawOutput,
   rootProjectName = "root",
   gradleModules = new Map(),
   gradleRootPath = "",
+  reportedProjects = new Set(),
 ) {
   if (typeof rawOutput === "string") {
     // Bug: 249. Get any sub-projects refered here
@@ -907,225 +1498,238 @@ export async function parseGradleDep(
     ) {
       rootProjectName = retMap.rootProject;
     }
-    let match = "";
     // To render dependency tree we need a root project
     const rootProject = gradleModules.get(rootProjectName);
+    if (!rootProject) {
+      thoughtLog(
+        `The Gradle report for ${rootProjectName} belongs to no module read from 'gradle properties', so it has no parent to hang its dependency tree from.`,
+      );
+      return {};
+    }
     const deps = [];
     const dependenciesList = [];
-    const keys_cache = {};
-    const deps_keys_cache = {};
-    let last_level = 0;
-    let last_bomref = rootProject["bom-ref"];
-    const first_bomref = last_bomref;
-    let last_project_bomref = first_bomref;
+    const depsByRef = new Map();
+    const firstBomRef = rootProject["bom-ref"];
     const level_trees = {};
-    level_trees[last_bomref] = [];
+    level_trees[firstBomRef] = [];
+    // Modules whose own report supplies their edges.
+    const reportedModuleRefs = new Set();
+    for (const key of reportedProjects) {
+      const reportedRef = gradleModules.get(key)?.["bom-ref"];
+      if (reportedRef && reportedRef !== firstBomRef) {
+        reportedModuleRefs.add(reportedRef);
+      }
+    }
     let scope;
     let profileName;
-    if (retMap?.projects) {
-      const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
-        ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
-        : [];
-      const modulesToScan = retMap.projects.filter(
-        (module) => !gradleModules.has(module),
-      );
-      if (modulesToScan.length > 0) {
-        const parallelPropTaskOut = executeParallelGradleProperties(
-          gradleRootPath,
-          modulesToScan.filter((module) => !modulesToSkip.includes(module)),
-        );
-        const splitPropTaskOut = splitOutputByGradleProjects(
-          parallelPropTaskOut,
-          ["properties"],
-        );
-
-        for (const module of modulesToScan) {
-          const propMap = parseGradleProperties(
-            splitPropTaskOut.get(module),
-            module,
-          );
-          const rootSubProject = propMap.rootProject;
-          if (rootSubProject) {
-            const rootSubProjectObj = await buildObjectForGradleModule(
-              rootSubProject === "root" ? module : rootSubProject,
-              propMap.metadata,
-            );
-            gradleModules.set(module, rootSubProjectObj);
-          }
-        }
-      }
-      const subDependsOn = [];
-      for (const sd of retMap.projects) {
-        if (gradleModules.has(sd)) {
-          subDependsOn.push(gradleModules.get(sd)["bom-ref"]);
-        }
+    // ancestors[level] is the bom-ref of the line most recently seen at that
+    // depth; ancestors[0] is the project the report belongs to.
+    const ancestors = [firstBomRef];
+    const lines = rawOutput.split("\n").map((l) => l.replaceAll("\r", ""));
+    // Modules some configuration resolved to a version, so that a failed,
+    // versionless request for one of them adds nothing.
+    const resolvedModules = new Set();
+    for (const line of lines) {
+      const parsed = parseGradleTreeLine(line);
+      if (
+        parsed?.group &&
+        parsed.version !== undefined &&
+        !parsed.failed &&
+        !parsed.constraint &&
+        !parsed.unresolvable
+      ) {
+        resolvedModules.add(`${parsed.group}:${parsed.name}`);
       }
-      level_trees[last_bomref] = subDependsOn;
     }
-    let stack = [last_bomref];
-    const depRegex =
-      /^.*?--- +(?<groupspecified>[^\s:]+) ?:(?<namespecified>[^\s:]+)(?::(?:{strictly [[]?)?(?<versionspecified>[^,\s:}]+))?(?:})?(?:[^->]* +-> +(?:(?<groupoverride>[^\s:]+):(?<nameoverride>[^\s:]+):)?(?<versionoverride>[^\s:]+))?/gm;
-    for (let rline of rawOutput.split("\n")) {
-      if (!rline) {
+    for (const rline of lines) {
+      const configurationName = parseGradleConfigurationHeader(rline);
+      if (configurationName) {
+        ancestors.length = 1;
+        profileName = configurationName;
+        scope = gradleConfigurationScope(configurationName);
+      }
+      if (rline.trim() === "") {
+        ancestors.length = 1;
         continue;
       }
-      rline = rline.replaceAll("\r", "");
-      const trimmedLine = rline.trim();
-      if (
-        trimmedLine.endsWith("(n)") ||
-        ((rline.startsWith("+--- ") || rline.startsWith("\\--- ")) &&
-          rline.includes("{strictly") &&
-          rline.includes("(c)"))
-      ) {
+      const parsed = parseGradleTreeLine(rline);
+      if (!parsed) {
+        continue;
+      }
+      // A line that names nothing usable still takes its place in the tree,
+      // so the lines under it get no parent rather than a wrong one.
+      if (parsed.unknown || parsed.unresolvable) {
+        ancestors.length = Math.min(ancestors.length, parsed.level);
+        continue;
+      }
+      const { level } = parsed;
+      const isProject = parsed.projectPath !== undefined;
+      if (parsed.constraint) {
+        ancestors.length = Math.min(ancestors.length, level);
         continue;
       }
+      // Only a dependency that failed to resolve can lack a version: Gradle
+      // prints every resolved one with the version it selected.
       if (
-        trimmedLine === "" ||
-        rline.startsWith("+--- ") ||
-        rline.startsWith("\\--- ")
+        !isProject &&
+        parsed.version === undefined &&
+        (!parsed.failed ||
+          resolvedModules.has(`${parsed.group}:${parsed.name}`))
       ) {
-        last_level = 1;
-        last_project_bomref = first_bomref;
-        last_bomref = last_project_bomref;
-        stack = [first_bomref];
+        ancestors.length = Math.min(ancestors.length, level);
+        continue;
       }
-      if (rline.includes(" - ") && !rline.startsWith("Project ':")) {
-        profileName = rline.split(" - ")[0];
-        if (profileName.toLowerCase().includes("test")) {
-          scope = "optional";
-        } else if (profileName.toLowerCase().includes("runtime")) {
-          scope = "required";
-        } else {
-          scope = undefined;
+      // A project the modules lack is named as Gradle publishes it by
+      // default: the last segment of its path, with the root project's group
+      // and version.
+      const name = isProject
+        ? parsed.projectPath.split(":").pop()
+        : parsed.name;
+      const group = isProject ? rootProject.group : parsed.group;
+      const version = isProject ? rootProject.version : parsed.version;
+      const gradleModule = isProject
+        ? gradleModuleForPath(
+            gradleModules,
+            parsed.projectPath,
+            rootProjectName,
+          )
+        : undefined;
+      if (isProject && !gradleModule && name === "") {
+        ancestors.length = Math.min(ancestors.length, level);
+        continue;
+      }
+      let purl;
+      let bomRef;
+      if (gradleModule) {
+        purl = gradleModule["purl"];
+        bomRef = gradleModule["bom-ref"];
+      } else {
+        try {
+          purl = build({
+            type: "maven",
+            namespace: group || null,
+            name,
+            version: version || null,
+            qualifiers: { type: "jar" },
+          });
+          bomRef = decodeURIComponent(purl);
+        } catch {
+          // A purl that cannot be built keeps a name-only bom-ref so the
+          // component still lands in the graph.
+          purl = undefined;
+          bomRef = name;
         }
       }
-      while ((match = depRegex.exec(rline))) {
-        const [
-          _line,
-          groupspecified,
-          namespecified,
-          versionspecified,
-          groupoverride,
-          nameoverride,
-          versionoverride,
-        ] = match;
-        let group = groupoverride || groupspecified;
-        let name = nameoverride || namespecified;
-        let version = versionoverride || versionspecified;
-        const prefix = rline.split("---")[0];
-        const level = Math.floor(prefix.length / 5) + 1;
-        if (version !== undefined || group === "project") {
-          // Project line has no version
-          // For multi sub-module projects such as :module:dummy:starter the regex is producing incorrect values
-          if (rline.includes("project ")) {
-            const tmpA = rline.split("project ");
-            if (tmpA && tmpA.length > 1) {
-              group = rootProject.group;
-              name = tmpA[1].split(" ")[0];
-              version = undefined;
-            }
+      const existing = depsByRef.get(bomRef);
+      // The project the report belongs to is the parent, not a component.
+      if (!existing && bomRef !== firstBomRef) {
+        let adep;
+        if (gradleModule) {
+          adep = gradleModule;
+        } else {
+          adep = {
+            group,
+            name: name,
+            version,
+            qualifiers: { type: "jar" },
+          };
+          if (version === undefined) {
+            delete adep.version;
           }
-          let purl;
-          let bomRef;
-          if (gradleModules.has(name)) {
-            purl = gradleModules.get(name)["purl"];
-            bomRef = gradleModules.get(name)["bom-ref"];
-          } else {
-            try {
-              purl = build({
-                type: "maven",
-                namespace:
-                  group !== "project" ? group : rootProject.group || null,
-                name: name.replace(/^:/, ""),
-                version:
-                  version !== undefined ? version : rootProject.version || null,
-                qualifiers: { type: "jar" },
-              });
-              bomRef = decodeURIComponent(purl);
-            } catch {
-              // A purl that cannot be built keeps a name-only bom-ref so the
-              // component still lands in the graph.
-              purl = undefined;
-              bomRef = name.replace(/^:/, "");
-            }
+          adep["purl"] = purl;
+          adep["bom-ref"] = bomRef;
+          if (scope) {
+            adep["scope"] = scope;
           }
-          keys_cache[`${bomRef}_${last_bomref}`] = true;
-          // Filter duplicates
-          if (!deps_keys_cache[bomRef]) {
-            deps_keys_cache[bomRef] = true;
-            let adep;
-            if (gradleModules.has(name)) {
-              adep = gradleModules.get(name);
-            } else {
-              adep = {
-                group: group !== "project" ? group : rootProject.group,
-                name: name,
-                version: version !== undefined ? version : rootProject.version,
-                qualifiers: { type: "jar" },
-              };
-              adep["purl"] = purl;
-              adep["bom-ref"] = bomRef;
-              if (scope) {
-                adep["scope"] = scope;
-              }
-              adep.properties = [];
-              if (profileName) {
-                adep.properties.push({
-                  name: "internal:GradleProfileName",
-                  value: profileName,
-                });
-              }
-              if (gradleRootPath && gradleRootPath !== ".") {
-                adep.properties.push({
-                  name: "cdx:gradle:GradleRootPath",
-                  value: gradleRootPath,
-                });
-              }
-            }
-            if (adep?.properties?.length === 0) {
-              delete adep.properties;
-            }
-            deps.push(adep);
+          adep.properties = [];
+          if (profileName) {
+            adep.properties.push({
+              name: "internal:GradleProfileName",
+              value: profileName,
+            });
           }
-          if (!level_trees[bomRef]) {
-            level_trees[bomRef] = [];
+          if (gradleRootPath && gradleRootPath !== ".") {
+            adep.properties.push({
+              name: "cdx:gradle:GradleRootPath",
+              value: gradleRootPath,
+            });
           }
-          if (level === 0) {
-            stack = [first_bomref];
-            stack.push(bomRef);
-          } else if (last_bomref === "") {
-            stack.push(bomRef);
-          } else if (level > last_level) {
-            const cnodes = level_trees[last_bomref] || [];
-            if (!cnodes.includes(bomRef)) {
-              cnodes.push(bomRef);
-            }
-            level_trees[last_bomref] = cnodes;
-            if (stack[stack.length - 1] !== bomRef) {
-              stack.push(bomRef);
+          if (parsed.failed) {
+            adep.properties.push({
+              name: "cdx:gradle:resolutionFailed",
+              value: "true",
+            });
+            if (
+              parsed.requestedVersion &&
+              parsed.requestedVersion !== version
+            ) {
+              adep.properties.push({
+                name: "cdx:gradle:requestedVersion",
+                value: parsed.requestedVersion.slice(0, 256),
+              });
             }
+          }
+        }
+        if (adep?.properties?.length === 0) {
+          delete adep.properties;
+        }
+        depsByRef.set(bomRef, { adep, isModule: !!gradleModule });
+        deps.push(adep);
+      } else if (existing && !existing.isModule) {
+        const { adep } = existing;
+        if (gradleScopeRank(scope) > gradleScopeRank(adep.scope)) {
+          if (scope) {
+            adep.scope = scope;
           } else {
-            for (let i = level; i <= last_level; i++) {
-              stack.pop();
-            }
-            const last_stack =
-              stack.length > 0 ? stack[stack.length - 1] : last_project_bomref;
-            const cnodes = level_trees[last_stack] || [];
-            if (!cnodes.includes(bomRef)) {
-              cnodes.push(bomRef);
-            }
-            level_trees[last_stack] = cnodes;
-            stack.push(bomRef);
+            delete adep.scope;
+          }
+          const profileProp = adep.properties?.find(
+            (p) => p.name === "internal:GradleProfileName",
+          );
+          if (profileProp && profileName) {
+            profileProp.value = profileName;
           }
-          last_level = level;
-          last_bomref = bomRef;
         }
+        // A dependency one configuration failed to resolve and another
+        // resolved is not a failed dependency.
+        if (!parsed.failed && adep.properties) {
+          adep.properties = adep.properties.filter(
+            (p) => !GRADLE_FAILURE_PROPERTIES.includes(p.name),
+          );
+          if (!adep.properties.length) {
+            delete adep.properties;
+          }
+        }
+      }
+      if (!level_trees[bomRef]) {
+        level_trees[bomRef] = [];
+      }
+      // A line whose parent was skipped has no known parent and gets no edge.
+      const parentRef =
+        ancestors.length >= level ? ancestors[level - 1] : undefined;
+      if (
+        parentRef &&
+        parentRef !== bomRef &&
+        !reportedModuleRefs.has(parentRef)
+      ) {
+        const cnodes = level_trees[parentRef] || [];
+        if (!cnodes.includes(bomRef)) {
+          cnodes.push(bomRef);
+        }
+        level_trees[parentRef] = cnodes;
+      }
+      ancestors.length = Math.min(ancestors.length, level);
+      if (ancestors.length === level) {
+        ancestors.push(bomRef);
       }
     }
+    const renamedRefs = markGradlePlatforms(depsByRef, level_trees);
     for (const lk of Object.keys(level_trees)) {
       dependenciesList.push({
-        ref: lk,
-        dependsOn: [...new Set(level_trees[lk])].sort(),
+        ref: renamedRefs.get(lk) || lk,
+        dependsOn: [
+          ...new Set(level_trees[lk].map((ref) => renamedRefs.get(ref) || ref)),
+        ].sort(),
       });
     }
     return {