build: add CycloneDX SBOM generation support #440
build: add CycloneDX SBOM generation support #440edeandrea merged 2 commits intodocling-project:mainfrom
Conversation
:java_duke: JaCoCo coverage report
|
|
||||||||||||||
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
| quarkus-github-api = "1.330.0" | ||
| quarkus-wiremock = "1.6.1" | ||
| wiremock = "3.13.2" | ||
| cyclonedx = "3.2.2" |
There was a problem hiding this comment.
I think 3.2.3 is the latest version.
There was a problem hiding this comment.
Upgrading to 3.2.3 is giving me error
Could not determine the dependencies of task ':docling-testcontainers:cyclonedxBom'.
> Could not create task ':docling-testcontainers:cyclonedxDirectBom'.
> Cannot mutate the artifacts of configuration ':docling-testcontainers:cyclonedxDirectBom' after the configuration was consumed as a variant. After a configuration has been observed, it should not be modified.
There was a problem hiding this comment.
We should try and figure out what the issue is. Is it an incompatibility between the cycloneDx gradle plugin & the overall Gradle and/or jvm version? Is the cyclonedx plugin not being applied properly? Does it not support Gradle's configuration cache?
edeandrea
left a comment
edeandrea
left a comment
There was a problem hiding this comment.
Thanks for this @NelsonMeleth ! I've added a few inline comments.
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
NelsonMeleth
force-pushed
the
main
branch
2 times, most recently
from
b0f1fcd to
b18748c
Compare
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
NelsonMeleth
changed the title
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
- Add docling-sbom.gradle.kts plugin for SBOM generation - Integrate SBOM artifacts into Maven publications - Add CycloneDX Gradle plugin dependency - Configure cyclonedxDirectBom task in build group Signed-off-by: Nelson Baby <nelson.b@ibm.com>
|
@copilot Does there need to be any additional configuration for jreleaser to do anything with the sboms that get generated? |
There was a problem hiding this comment.
Pull request overview
Adds CycloneDX SBOM generation into the Gradle build (via a new convention plugin) and attempts to publish the generated SBOM alongside existing Maven artifacts, so released modules can ship a per-project SBOM.
Changes:
- Add CycloneDX Gradle plugin/version-catalog entries and make it available to
buildSrc. - Introduce a
docling-sbomconvention plugin that applies CycloneDX and exposescyclonedxDirectBomunder thebuildtask group. - Attach CycloneDX task outputs as additional artifacts in the
docling-releaseMaven publication.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
gradle/libs.versions.toml |
Adds CycloneDX version + library/plugin entries to the version catalog. |
buildSrc/src/main/kotlin/docling-sbom.gradle.kts |
New convention plugin applying org.cyclonedx.bom and grouping the BOM task under build. |
buildSrc/src/main/kotlin/docling-release.gradle.kts |
Wires SBOM generation outputs into Maven publication artifacts. |
buildSrc/build.gradle.kts |
Adds CycloneDX Gradle plugin dependency to buildSrc so the convention plugin can apply it. |
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
Signed-off-by: Nelson Baby <nelson.b@ibm.com>
|
HTML test reports are available as workflow artifacts (zipped HTML). • Download: Artifacts for this run |
edeandrea
left a comment
edeandrea
left a comment
There was a problem hiding this comment.
Thanks @NelsonMeleth !
Uh oh!
There was an error while loading. Please reload this page.