Adds Software BOM to releases

Signed-off-by: Matthew Pope <[email protected]>
amazon-ion · Nov 18, 2022 · 9531842 · 9531842
1 parent ff91d4c
commit 9531842
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.github/workflows/publish-release-artifacts.yml b/.github/workflows/publish-release-artifacts.yml
@@ -48,7 +48,7 @@ jobs:
           submodules: recursive
       - uses: gradle/gradle-build-action@v2
         with:
-          arguments: build
+          arguments: build cyclonedxBom
       - name: Upload Jar to GitHub release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -58,4 +58,5 @@ jobs:
         # It may also need to be able to upload more than one file.
         run: |
           gh release upload "v$(<project.version)" "build/libs/ion-java-$(<project.version).jar"
+          gh release upload "v$(<project.version)" "build/reports/bom.json"
   # TODO: Add `publish-to-maven-central` job
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -7,6 +7,7 @@ plugins {
     `maven-publish`
     jacoco
     signing
+    id("org.cyclonedx.bom") version "1.7.2"
     // TODO: static analysis. E.g.:
     // id("com.diffplug.spotless") version "6.11.0"
     // id("com.github.spotbugs") version "4.8.0"
@@ -107,6 +108,11 @@ tasks {
     withType<Sign> {
         setOnlyIf { isReleaseVersion && gradle.taskGraph.hasTask("publish") }
     }
+
+    cyclonedxBom {
+        setIncludeConfigs(listOf("runtimeClasspath"))
+        setSkipConfigs(listOf("compileClasspath", "testCompileClasspath"))
+    }
 }
 
 publishing {