[Gradle] Don't use full multi-threading, SBOMs can be completely wrong

[malice00]

When using the feature GRADLE_MULTI_THREADED on large projects, the output of the dependency-tree can be mangled and there is no guarantee the same SBOM is generated between multiple runs!

To fix this, I added the parameter '--no-parallel' to the Gradle-command, which in my tests didn't show a significant difference in duration. The output SBOM however was consistent every time, although in one of the projects there is a difference with the non-multithreaded version in the versions of dependencies!
Unfortunately this is caused by Gradle itself -- manual inspection of the outputs of all commands shows, that Gradle is actually reporting different versions of dependencies for some modules in the project! I assume this is something similar to Maven: because there can only be 1 version of a JAR in the classpath, it gets corrected to specific version (by whatever kind of resolution). This would mean, that the current non-multithreaded version would actually be reporting false dependencies in some cases...

[prabhu]

I can imagine why this might be happening. Do you have an example for the mangled sbom and the sbom where the version number doesn't match? Is this issue reproducible on a fresh repo with the first build?

[malice00]

It's not the SBOM that's mangled, it's Gradle's output. Although the generated SBOM then also has some weird issues (like duplicate 'GradleProfileName' entries.
The issue is reproducible, but the results are random -- so there might actually be a run where it would not happen!

Anyway, I was testing this with Fineract (commit 02296305c) using cdxgen master (commit 34e13f1) vs this branch.
Attached is a ZIP containing 2 dirs, one for each version of cdxgen, each containing a file with the commands used.

For the mangled output, check 'master/multithread.out', eg from line 10605.
For the differing versions, compare 'no-parallel/multithread.out' and 'no-parallel/singlethread.out' for module ':integration-tests' (eg line 46376 vs 47685)

proof.zip