Add image integration tests for new DS_EXPERIMENTAL_GRADLE_BUILTIN_PARSER

Proposal

Once Implement gemnasium parser for gradle dependenc... (#360626 - closed) • Philip Cunningham • 16.10 • On track has been completed, we can leverage the new DS_EXPERIMENTAL_GRADLE_BUILTIN_PARSER environment variable to add new image integration tests to cover all the scenarios that we weren't able to accommodate using the previous gemnasium-gradle-plugin.

Implementation Plan

Improve image integration test coverage:

  1. Add a test with a single dependency with different versions in different scopes (configurations). This test covers the case discussed here. For example:

    dependencies {
    testRuntimeClasspath 'org.slf4j:slf4j-api:1.7.31'
    implementation 'org.slf4j:slf4j-api:1.7.30'
    runtimeClasspath 'org.slf4j:slf4j-api:1.7.25'
}

    Add E2E test with a single dependency with diff... (gitlab-org/security-products/analyzers/gemnasium!645 - merged) • Philip Cunningham • 16.10

  2. Add a test to handle gradle dependency constraints as described in this comment. To be more specific, we must be able to show that we can successfully execute a dependency scan against the files in this branch.

    Add E2E test for api dependencies (gitlab-org/security-products/analyzers/gemnasium!653 - merged) • Philip Cunningham • 16.10

  3. Add a test to handle the the situation where gradle dependencies fails to resolve a dependency, as described in this comment.

    Add E2E test for api dependencies (gitlab-org/security-products/analyzers/gemnasium!653 - merged) • Philip Cunningham • 16.10

  4. Add a test against a large open-source gradle project, such as k9mail/k-9. See this comment for more details

    Add E2E test for large project (gitlab-org/security-products/analyzers/gemnasium!661 - merged) • Philip Cunningham • 16.11

  5. [ ] Add a test with large dependency files, such as the 316 MB file discussed here. Note: I didn't provide a link to the "project with a large number of scopes", and I can't remember which project I used for this, so unfortunately you'll need to dig around to find such a project. Having said that, perhaps this case is covered already by step 4. above, if that step happens to create large dependency files (for example, over 100 MB).

/cc @thiagocsf @johncrowley

Edited by Philip Cunningham