fix(gradle): exclude development dependencies

[knqyf263]

Description

Dependencies only with included in testCompileClasspath and testRuntimeClasspath should be marked as development dependencies and only included when --include-dev-deps is specified. The document also needs to be fixed.

junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath
org.apache.commons:commons-lang3:3.12.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
empty=annotationProcessor,testAnnotationProcessor

Discussed in #8750

[sneaky-potato]

Hi can I work on this issue?

[knqyf263]

Sure. I assigned you.

[sneaky-potato]

I kind of skimmed through the code base and found this function which seems to exclude dev dependencies. Could you confirm if I'm going in the right direction with this, could use some pointers for this issue? Also, is there a channel through which collaborators communicate, in case I run into some issue?

[knqyf263]

We need to flag development packages, like npm, so they will be excluded by the function you pointed out.

trivy/pkg/dependency/parser/nodejs/npm/parse.go

Line 149 in 7a58ccb

Dev: pkg.Dev,

You can see a grade lockfile parser here.
https://github.com/aquasecurity/trivy/blob/7a58ccbc7fffdfb1e5ccff9fd4cb6ca08c03a9ea/pkg/dependency/parser/gradle/lockfile/parse.go

Also, is there a channel through which collaborators communicate, in case I run into some issue?

We do have a Slack channel, but considering that future contributors might refer to this issue as a good first issue, I think it's preferable to communicate on GitHub.

[sneaky-potato]

Hi I missed updating the docs for this one
Could we reopen this issue, I will link a PR for updating the docs

[knqyf263]

You can just link to this closed issue.