Upgrading from JFrog CLI v2.111.0 to v2.112.0 breaks back-to-back sequential execution of jf audit --gradle

[jarodcanal]

Describe the bug

Hi, I have a job in my Gitlab pipeline to scan my project source using XRay.
My project is made up of a Gradle backend and a npm frontend.
Gradle version is 9.6.1.
Gradle daemon is enabled.

Script section of my job is the following one:

  script:
    - *set_home_directory_to_project_directory
    - set -euo pipefail
    - jf config show
    - echo 'jf rt ping:' $(jf rt ping)
    # audit backend all dependencies
    - jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend"
    - jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend" --format=sarif > jfrog-audit-backend-all-dependencies-report.sarif
    # audit backend prod dependencies + SBOM
    - jf audit --gradle --use-wrapper --exclude-test-deps --sca --fail=false --working-dirs="backend"
    - jf audit --gradle --use-wrapper --exclude-test-deps --sca --fail=false --working-dirs="backend" --format=sarif > jfrog-audit-backend-prod-dependencies-report.sarif
    - jf audit --gradle --use-wrapper --exclude-test-deps --sca --fail=false --working-dirs="backend" --sbom --format=cyclonedx > backend-prod-sbom.json
    # audit frontend dev dependencies
    - jf audit --npm --dep-type=devOnly --sca --fail=false --working-dirs="frontend"
    - jf audit --npm --dep-type=devOnly --sca --fail=false --working-dirs="frontend" --format=sarif > jfrog-audit-frontend-dev-dependencies-report.sarif
    # audit frontend prod dependencies + SBOM
    - jf audit --npm --dep-type=prodOnly --sca --fail=false --working-dirs="frontend"
    - jf audit --npm --dep-type=prodOnly --sca --fail=false --working-dirs="frontend" --format=sarif > jfrog-audit-frontend-prod-dependencies-report.sarif
    - jf audit --npm --dep-type=prodOnly --sca --fail=false --working-dirs="frontend" --sbom --format=cyclonedx > frontend-prod-sbom.json

This jobs works like a charm with JFrog CLI 2.111.0.
But with the Fix - Gradle dep tree references missing output files #791 introduced in JFrog CLI 2.112.0, it stopped working because it crashes on second jf audit --gradle call, complaining about missing gradledeptree.out.
I could not find a way to make it work with version 2.112.0, and I would like to avoid splitting my jf audit calls in multiple jobs.
Thanks.

Current behavior

Jobs fails in the second jf audit --gradle call with the following:

...
$ echo 'jf rt ping:' $(jf rt ping)
jf rt ping: OK
$ jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend"
05:01:41 [Info] ####### Starting jf audit Scan #######
05:01:41 [Info] Command flags: [--fail=false --gradle=true --sca=true --working-dirs=backend]
05:01:42 [Info] Scanning path: /builds/dummy/myapp/backend
05:01:42 [Info] Generating SBOM...
05:01:42 [Info] Calculating Gradle dependencies...
05:01:42 [Info] Running gradle deps tree command: /usr/bin/sh ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1782968502-3335928611/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1782968502-3335928611/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true -Dcom.jfrog.includeIncludedBuilds=false
05:03:26 [Info] SBOM generated; found 285 library components (duration 1m43.892939452s)
05:03:26 [Info] Performing scans on project com.dummy/myapp-backend [Gradle]
05:03:26 [Info] Advanced Security is not enabled on this system, so Advanced Security scans were skipped...
05:03:26 [Info] [Thread 2] Running SCA scan...
05:03:26 [Info] Waiting for scan to complete on JFrog Xray...
05:03:36 [Info] [Thread 2] No SCA vulnerabilities were found (duration 10.272497899s)
05:03:36 [Info] ####### jf audit Scan Finished #######
 In addition to SCA, the ‘jf audit’ command supports the following Advanced Security scans: 'Contextual Analysis', 'Secrets Detection', 'IaC', and ‘SAST’.
These scans are available within Advanced Security license. Read more - https://docs.jfrog.com/security/docs/advanced-security
Vulnerable Dependencies
+-----------------------------------------+
|  No vulnerable dependencies were found  |
+-----------------------------------------+
$ jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend" --format=sarif > jfrog-audit-backend-all-dependencies-report.sarif
05:03:36 [Info] ####### Starting jf audit Scan #######
05:03:36 [Info] Command flags: [--fail=false --format=sarif --gradle=true --sca=true --working-dirs=backend]
05:03:36 [Info] Scanning path: /builds/dummy/myapp/backend
05:03:36 [Info] Generating SBOM...
05:03:36 [Info] Calculating Gradle dependencies...
05:03:36 [Info] Running gradle deps tree command: /usr/bin/sh ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1782968616-3586474952/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1782968616-3586474952/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true -Dcom.jfrog.includeIncludedBuilds=false
05:03:37 [Info] Performing scans on project /builds/dummy/myapp/backend [Gradle]
05:03:37 [Info] ####### jf audit Scan Finished #######
05:03:37 [Info] Trace ID for JFrog Platform logs: 524c4b3932331b40
05:03:37 [Error] target '/builds/dummy/myapp/backend [Gradle]' errors:
failed to generate SBOM for /builds/dummy/myapp/backend: failed to build dependency tree: failed while building 'gradle' dependency tree: open /tmp/jfrog.cli.temp.-1782968616-3586474952/gradledeptree.out: no such file or directory
...

Reproduction steps

Execute the following steps sequentially in an active CI job loop against a single project structured inside a subfolder with Gradle daemon enabled:

1. jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend"
2. jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend" --format=sarif > report.sarif

First step completes successfully.
Second step fails with missing file error.

Expected behavior

I would expect the job to run flawlessly as with JFrog 2.111.0.
With JFrog 2.111.0, I get traces like the following:

...
$ echo 'jf rt ping:' $(jf rt ping)
jf rt ping: OK
$ jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend"
05:21:01 [Info] ####### Starting jf audit Scan #######
05:21:01 [Info] Command flags: [--fail=false --gradle=true --sca=true --working-dirs=backend]
05:21:02 [Info] Scanning path: /builds/dummy/myapp/backend
05:21:02 [Info] Generating SBOM...
05:21:02 [Info] Calculating Gradle dependencies...
05:21:02 [Info] Running gradle deps tree command: /usr/bin/sh ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1782969662-2549199422/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1782969662-2549199422/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true -Dcom.jfrog.includeIncludedBuilds=false
05:22:47 [Info] SBOM generated; found 285 library components (duration 1m45.578724161s)
05:22:47 [Info] Performing scans on project com.dummy/myapp-backend [Gradle]
05:22:47 [Info] Advanced Security is not enabled on this system, so Advanced Security scans were skipped...
05:22:47 [Info] [Thread 2] Running SCA scan...
05:22:47 [Info] Waiting for scan to complete on JFrog Xray...
05:22:58 [Info] [Thread 2] No SCA vulnerabilities were found (duration 10.214420455s)
05:22:58 [Info] ####### jf audit Scan Finished #######
 In addition to SCA, the ‘jf audit’ command supports the following Advanced Security scans: 'Contextual Analysis', 'Secrets Detection', 'IaC', and ‘SAST’.
These scans are available within Advanced Security license. Read more - https://docs.jfrog.com/security/docs/advanced-security
Vulnerable Dependencies
+-----------------------------------------+
|  No vulnerable dependencies were found  |
+-----------------------------------------+
$ jf audit --gradle --use-wrapper --sca --fail=false --working-dirs="backend" --format=sarif > jfrog-audit-backend-all-dependencies-report.sarif
05:22:58 [Info] ####### Starting jf audit Scan #######
05:22:58 [Info] Command flags: [--fail=false --format=sarif --gradle=true --sca=true --working-dirs=backend]
05:22:58 [Info] Scanning path: /builds/dummy/myapp/backend
05:22:58 [Info] Generating SBOM...
05:22:58 [Info] Calculating Gradle dependencies...
05:22:58 [Info] Running gradle deps tree command: /usr/bin/sh ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1782969778-665542691/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1782969778-665542691/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true -Dcom.jfrog.includeIncludedBuilds=false
05:22:59 [Info] SBOM generated; found 285 library components (duration 1.240892207s)
05:22:59 [Info] Performing scans on project com.dummy/myapp-backend [Gradle]
05:22:59 [Info] Advanced Security is not enabled on this system, so Advanced Security scans were skipped...
05:22:59 [Info] [Thread 2] Running SCA scan...
05:22:59 [Info] Waiting for scan to complete on JFrog Xray...
05:23:09 [Info] [Thread 2] No SCA vulnerabilities were found (duration 10.232903302s)
05:23:09 [Info] ####### jf audit Scan Finished #######
$ jf audit --gradle --use-wrapper --exclude-test-deps --sca --fail=false --working-dirs="backend"
...

JFrog CLI-Security version

1.31.1

JFrog CLI version (if applicable)

2.112.0

Operating system type and version

GitLab Enterprise Edition v18.11.5-ee

JFrog Xray version

3.143.19