How to prevent descending into sub-projects?

Help/Discuss
1

We have an Android project that contains our own code, plus code that is pulled in from another repository not under our control (vendor-dependencies.) One of tasks requires security scan, and I need to block that scan on certain sub-projects. How can I configure this?

2

Some log detail:

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:cyclonedxBom'.
> Could not resolve all dependencies for configuration ':app:debugAndroidTestCompileClasspath'.
   > More than one variant of project :data matches the consumer attributes:
       - Configuration ':data:debugApiElements' variant android-aidl:
           - Unmatched attributes:
               - Found artifactType 'android-aidl' but wasn't required.
               - Found com.android.build.api.attributes.VariantAttr 'debug' but wasn't required.
           - Compatible attributes:
               - Required com.android.build.api.attributes.BuildTypeAttr 'debug' and found compatible value 'debug'.
               - Required org.gradle.usage 'java-api' and found compatible value 'java-api'.
               - Required org.jetbrains.kotlin.platform.type 'androidJvm' and found compatible value 'androidJvm'.
       - Configuration ':data:debugApiElements' variant android-manifest:
           - Unmatched attributes:
               - Found artifactType 'android-manifest' but wasn't required.
               - Found com.android.build.api.attributes.VariantAttr 'debug' but wasn't required.
           - Compatible attributes:
               - Required com.android.build.api.attributes.BuildTypeAttr 'debug' and found compatible value 'debug'.
               - Required org.gradle.usage 'java-api' and found compatible value 'java-api'.
               - Required org.jetbrains.kotlin.platform.type 'androidJvm' and found compatible value 'androidJvm'.
       - Configuration ':data:debugApiElements' variant android-renderscript:
           - Unmatched attributes:
               - Found artifactType 'android-renderscript' but wasn't required.
               - Found com.android.build.api.attributes.VariantAttr 'debug' but wasn't required.
           - Compatible attributes:
               - Required com.android.build.api.attributes.BuildTypeAttr 'debug' and found compatible value 'debug'.
               - Required org.gradle.usage 'java-api' and found compatible value 'java-api'.
               - Required org.jetbrains.kotlin.platform.type 'androidJvm' and found compatible value 'androidJvm'.
       - Configuration ':data:debugApiElements' variant android-symbol-with-package-name:
           - Unmatched attributes:
               - Found artifactType 'android-symbol-with-package-name' but wasn't required.
               - Found com.android.build.api.attributes.VariantAttr 'debug' but wasn't required.
           - Compatible attributes:
               - Required com.android.build.api.attributes.BuildTypeAttr 'debug' and found compatible value 'debug'.
               - Required org.gradle.usage 'java-api' and found compatible value 'java-api'.
               - Required org.jetbrains.kotlin.platform.type 'androidJvm' and found compatible value 'androidJvm'.
3

Hi, Mark!
Have you found a workaround for this issue?