gradle/github-dependency-graph-gradle-plugin

Manifest file location may point to non-existent build file

Closed this issue · 1 comments

bigdaz commented

The manifest file location for a build invocation is always set to build file of the root project. In some cases, this file will not exist. Instead, we should use the Settings file location, which will always exist.

Alternatively, we could use the Settings file location only if the root project build file doesn't exist. This would avoid changing the manifest location for most existing manifests: changing the manifest file location results in closing all existing security alerts and opening new ones.

(I think it's ok to change this globally at this early stage of the product, but it's worth considering).

bigdaz commented

Fixed in 1ff247a.
The settings file is preferred but build file is used if settings does not exist.
The only case where this can point to a non-existent file is if neither Settings nor Build script are present, and this can only occur with Gradle < 7.