This message was deleted.

That's what I run:

./gradlew buildHealth cyclonedxBom

This leads to the following error (with gradle 8, just a warning with gradle 7)

- Gradle detected a problem with the following location: '<path-to-root-project>\build\reports\dependency-analysis\build-health-report.txt'.
    
    Reason: Task ':buildHealth' uses this output of task ':cyclonedxBom' without declaring an explicit or implicit dependency. This can lead to incorrect results being produced, depending on what order the tasks are executed.
    
    Possible solutions:
      1. Declare task ':cyclonedxBom' as an input of ':buildHealth'.
      2. Declare an explicit dependency on ':cyclonedxBom' from ':buildHealth' using Task#dependsOn.
      3. Declare an explicit dependency on ':cyclonedxBom' from ':buildHealth' using Task#mustRunAfter.
    
    Please refer to <https://docs.gradle.org/8.0/userguide/validation_problems.html#implicit_dependency> for more details about this problem.

When I run the tasks separately everything works fine. First I thought the reason for that was, that the CycloneDx plugin has a

destination

property which is marked as

@OutputDirectory

(see here ) and is by default at

${buildDir}/reports

. And when I configure the

cyclonedxBom

as follows, the error is gone:

tasks.named("cyclonedxBom") {
    destination = file("${buildDir}/reports/cyclonedx")
}

Want I find strange is, that when running the

cyclonedxBom

task together with the

testAggregateTestReport

of the Test Report Aggregation Plugin, which uses

${buildDir}/reports/tests

as output directory, I don't have the same issue. So I'm not sure if it is maybe the Dependency Analysis Plugin declaring its inputs in a strange way. Has anybody an idea who "is at fault" here?

What's strange is that Gradle says that

build\reports\dependency-analysis\build-health-report.txt

is an output of

cyclonedxBom

, and input of

buildHealth

(from the name, looks more like an output of the latter).

Yeah it's definitely an output of

buildHealth

And gradle probably thinks that it is an output of

cyclonedxBom

, because this task declares

build/reports

as an output directory and this applies recursively, meaning every file in all sub directories is an output file of this task. But I agree, that it is strange why apparently gradle thinks it is an input of

buildHealth

(and therefore my question if it is maybe a weird configuration issue in the dependency analysis plugin)

Ah, apparently,

buildHealth

in root project takes as input the outputs of

generateBuildHealth

task which includes this

build-health-report.txt

, and yes CycloneDX declaring

build/reports

as an output directory is wrong. So the culprit is CycloneDX here, it should either put everything in a subdirectory it "owns", or somehow declare a list of output files (it can still have an outputDirectory property to compute those output files, but as

@Internal

then)

Ahh okay, didn't find that, thanks for confirming! I will open an issue on the CycloneDX Plugin