spom

Author: Daan Hoogland

.github/workflows/sbom.yml

@@ -15,9 +15,16 @@
 # specific language governing permissions and limitations
 # under the License.
 
-- uses: sbomify/github-action@master
-  env:
-    LOCK_FILE: ui/package-lock.json
-    OUTPUT_FILE: sbom.ui.cdx.json
-    UPLOAD: false
-    ENRICH: true
+name: generate sboms
+
+jobs:
+  build:
+    name: ui sbom
+    uses: sbomify/github-action@master
+    env:
+      LOCK_FILE: ui/package-lock.json
+      OUTPUT_FILE: sbom.ui.cdx.json
+      COMPONENT_NAME: my-app
+      COMPONENT_VERSION: ${{ github.ref_name }}
+      UPLOAD: false
+      ENRICH: true

pom.xml

@@ -848,6 +848,32 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+                <version>2.9.1</version>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>makeAggregateBom</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <projectType>application</projectType>
+                    <schemaVersion>1.6</schemaVersion>
+                    <includeBomSerialNumber>true</includeBomSerialNumber>
+                    <includeCompileScope>true</includeCompileScope>
+                    <includeProvidedScope>true</includeProvidedScope>
+                    <includeRuntimeScope>true</includeRuntimeScope>
+                    <includeSystemScope>true</includeSystemScope>
+                    <includeTestScope>false</includeTestScope>
+                    <includeLicenseText>false</includeLicenseText>
+                    <outputFormat>all</outputFormat>
+                    <outputName>ACS.sbom</outputName>
+                </configuration>
+            </plugin>
         </plugins>
         <pluginManagement>
             <plugins>