Scanner not picking the build.gradle file but scans the other jar files available in the repo

[arunkumar-thangavel]

We are using the home brew version of dependency-check and when we try to scan a repo using the below command, it picks jar files from sub folders but not grabbing the build.gradle file to scan the CVEs.

dependency-check -s “projectPath” --enableExperimental -f JSON -o MyRepo.dep-check.json -n

is it the expected behaviour or do we have to do additional configuration to make it pick the build.gradle file?

[jeremylong]

The CLI should not used to scan gradle projects. Use the gradle plugin instead. If you really must use the CLI, then you have to run something like a copy dependencies task. Either way, if you likely need to modify the build.gradle or use an init-script.