Generate SBOM (#411)

CycloneDX format only for now.
leplusorg · Dec 14, 2024 · 4f82e54 · 4f82e54
1 parent 1ae1670
commit 4f82e54
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 14 deletions.
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -71,22 +71,17 @@ jobs:
         run: |
           if [ -z "${MAVEN_GPG_PASSPHRASE}" ]
           then
-            # Forcing dependency check version to a version compatible
-            # with Java 8 since version does not matter due to
-            # dependencyCheck.skip=true. But otherwise Maven initialization
-            # fails with error: "java.lang.TypeNotPresentException:
-            # Type org.owasp.dependencycheck.maven.CheckMojo not present".
-            # shellcheck disable=SC2086
-            ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.version=10.0.4 -DdependencyCheck.skip=true -Dgpg.skip=true verify
+            GPG_SKIP=true
           else
-            # Forcing dependency check version to a version compatible
-            # with Java 8 since version does not matter due to
-            # dependencyCheck.skip=true. But otherwise Maven initialization
-            # fails with error: "java.lang.TypeNotPresentException:
-            # Type org.owasp.dependencycheck.maven.CheckMojo not present".
-            # shellcheck disable=SC2086
-            ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.version=10.0.4 -DdependencyCheck.skip=true verify
+            GPG_SKIP=false
           fi
+          # Forcing dependency check version to a version compatible
+          # with Java 8 since version does not matter due to
+          # dependencyCheck.skip=true. But otherwise Maven initialization
+          # fails with error: "java.lang.TypeNotPresentException:
+          # Type org.owasp.dependencycheck.maven.CheckMojo not present".
+          # shellcheck disable=SC2086
+          ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.version=10.0.4 -DdependencyCheck.skip=true -Dgpg.skip=${GPG_SKIP} verify
       - name: Publish site
         env:
           GITHUB_TOKEN: ${{ github.token }}

diff --git a/pom.xml b/pom.xml
@@ -84,6 +84,7 @@ limitations under the License.
     <dependencyCheck.version>11.1.1</dependencyCheck.version>
     <dependencyCheck.skip>false</dependencyCheck.skip>
     <dependencyCheck.threshold>7</dependencyCheck.threshold>
+    <cyclonedx.skip>false</cyclonedx.skip>
   </properties>
   <dependencies>
     <dependency>
@@ -317,6 +318,22 @@ limitations under the License.
           <scmBranch>gh-pages</scmBranch>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+        <version>2.9.1</version>
+        <configuration>
+	  <skip>${cyclonedx.skip}</skip>
+        </configuration>
+        <executions>
+          <execution>
+            <phase>package</phase>
+            <goals>
+              <goal>makeAggregateBom</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
   <reporting>