[Feature Request]: Integrate CycloneDX Plugin for SBOM Generation

[dsanderbi]

What would you like to happen?

I suggest integrating the org.cyclonedx Maven Plugin into Apache Hop to facilitate the generation of Software Bill of Materials (SBOM) files.

It would be highly beneficial if the generated SBOM file could be included in every release package.

<plugin>
    <groupId>org.cyclonedx</groupId>
    <artifactId>cyclonedx-maven-plugin</artifactId>
    <version>2.8.1</version>
    <configuration>
        <projectType>library</projectType>
        <schemaVersion>1.5</schemaVersion>
        <includeBomSerialNumber>true</includeBomSerialNumber>
        <includeCompileScope>true</includeCompileScope>
        <includeProvidedScope>true</includeProvidedScope>
        <includeRuntimeScope>true</includeRuntimeScope>
        <includeSystemScope>true</includeSystemScope>
        <includeTestScope>false</includeTestScope>
        <includeLicenseText>false</includeLicenseText>
        <outputReactorProjects>true</outputReactorProjects>
        <outputFormat>json</outputFormat>
        <outputName>bom</outputName>
        <outputDirectory>${project.build.directory}</outputDirectory>
        <verbose>false</verbose>
    </configuration>
    <executions>
        <execution>
            <goals>
                <goal>makeAggregateBom</goal>
            </goals>
            <phase>package</phase>
        </execution>
    </executions>
</plugin>

Issue Priority

Priority: 2

Issue Component

Component: Other

[hansva]

Great idea!
.take-issue

[hansva]

Added the cyclonedx maven plugin to generate SBOM files.

Placed the plugin into a profile that will only be executed during our release process.
The SBOM generation does take quite some additional CPU time.