Wrong implicit dependency with ProGuard and distribution task

Question

In my Gradle 7.3.3 build I am using ProGuard to obfuscate my library which I am then using as the content of my distribution as follows:

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'com.guardsquare:proguard-gradle:7.1.0'
    }
}

plugins {
    id 'java'
    id 'maven-publish'
    id 'com.github.spotbugs' version '5.0.2'
    id 'com.github.johnrengelman.shadow' version '6.1.0'
    id 'kr.motd.sphinx' version '2.10.0'
    id 'distribution'
}

version = '1.0.2'

repositories {
    mavenCentral()
}

   
dependencies {
    compileOnly group: 'com.google.code.findbugs', name: 'jsr305', version: '3.0.0'
    
    implementation 'org.apache.commons:commons-text:1.9'

}

shadowJar {
   relocate '...'
}

task obfuscate(type: proguard.gradle.ProGuardTask, dependsOn: [shadowJar]) {
    injars shadowJar
    outjars "build/libs/mylib-${project.version}.jar" 
    libraryjars files(configurations.shadow.collect())
}
   
distributions {
 // inputFile.from(obfuscate) // this is not accepted
    main {
        contents {
            from obfuscate
        }
    }
}

distTar.dependsOn(obfuscate)
distZip.dependsOn(obfuscate)

When executing the build, I am getting this warning:

> Task :obfuscate
Note: there were 2274 duplicate class definitions.
      (https://www.guardsquare.com/proguard/manual/troubleshooting#duplicateclass)

> Task :jar
Execution optimizations have been disabled for task ':jar' to ensure correctness due to the following reasons:
  - Gradle detected a problem with the following location: 'C:\company\repos\wmylib\build\libs\mylib-1.0.2.jar'. Reason: Task ':distTar
' uses this output of task ':jar' without declaring an explicit or implicit dependency. This can lead to incorrect results being produced, depending on what order the tasks are
executed. Please refer to https://docs.gradle.org/7.3.3/userguide/validation_problems.html#implicit_dependency for more details about this problem.
  - Gradle detected a problem with the following location: 'C:\company\repos\mylib\build\libs\mylib-1.0.2.jar'. Reason: Task ':distZip
' uses this output of task ':jar' without declaring an explicit or implicit dependency. This can lead to incorrect results being produced, depending on what order the tasks are
executed. Please refer to https://docs.gradle.org/7.3.3/userguide/validation_problems.html#implicit_dependency for more details about this problem.

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.3.3/userguide/command_line_interface.html#sec:command_line_warnings

Execution optimizations have been disabled for 1 invalid unit(s) of work during this build to ensure correctness.
Please consult deprecation warnings for more details.

I am trying to figure out how to let the distribution task know about it's proper upstream task, as it still seems to associate itself with the jar task, even though the content is defined to come from obfuscate

I have commented out the approaches I have tried, none of them gave good result.

I can't find a way to eliminate this warning, can someone help me with this?