Add SBOM support

build.gradle

@@ -15,6 +15,7 @@ buildscript {
     dependencies {
         classpath 'org.ajoberstar.grgit:grgit-gradle:latest.release'
         classpath 'com.gorylenko.gradle-git-properties:gradle-git-properties:latest.release'
+        classpath 'org.cyclonedx:cyclonedx-gradle-plugin:latest.release'
         classpath "org.springframework.boot:spring-boot-gradle-plugin:$springBootVersion"
     }
 }

buildscript-gradle.lockfile

@@ -1,31 +1,73 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.fasterxml.jackson.core:jackson-annotations:2.14.2=classpath
-com.fasterxml.jackson.core:jackson-core:2.14.2=classpath
-com.fasterxml.jackson.core:jackson-databind:2.14.2=classpath
-com.fasterxml.jackson.module:jackson-module-parameter-names:2.14.2=classpath
-com.fasterxml.jackson:jackson-bom:2.14.2=classpath
+aopalliance:aopalliance:1.0=classpath
+com.ethlo.time:itu:1.7.0=classpath
+com.fasterxml.jackson.core:jackson-annotations:2.15.3=classpath
+com.fasterxml.jackson.core:jackson-core:2.15.3=classpath
+com.fasterxml.jackson.core:jackson-databind:2.15.3=classpath
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.15.3=classpath
+com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.15.3=classpath
+com.fasterxml.jackson.module:jackson-module-parameter-names:2.15.3=classpath
+com.fasterxml.jackson:jackson-bom:2.15.3=classpath
+com.fasterxml.woodstox:woodstox-core:6.5.1=classpath
+com.github.package-url:packageurl-java:1.4.1=classpath
 com.google.code.findbugs:jsr305:3.0.2=classpath
+com.google.guava:failureaccess:1.0.1=classpath
+com.google.guava:guava:32.0.1-jre=classpath
+com.google.inject:guice:5.1.0=classpath
 com.googlecode.javaewah:JavaEWAH:1.2.3=classpath
 com.gorylenko.gradle-git-properties:gradle-git-properties:2.4.2=classpath
+com.networknt:json-schema-validator:1.0.87=classpath
 commons-codec:commons-codec:1.16.0=classpath
+commons-io:commons-io:2.15.1=classpath
 io.spring.gradle:dependency-management-plugin:1.1.5=classpath
+javax.annotation:javax.annotation-api:1.2=classpath
+javax.inject:javax.inject:1=classpath
 net.java.dev.jna:jna-platform:5.13.0=classpath
 net.java.dev.jna:jna:5.13.0=classpath
 org.ajoberstar.grgit:grgit-core:5.2.2=classpath
 org.ajoberstar.grgit:grgit-gradle:5.2.2=classpath
 org.antlr:antlr4-runtime:4.7.2=classpath
 org.apache.commons:commons-compress:1.25.0=classpath
+org.apache.commons:commons-lang3:3.13.0=classpath
 org.apache.httpcomponents.client5:httpclient5:5.3.1=classpath
 org.apache.httpcomponents.core5:httpcore5-h2:5.2.4=classpath
 org.apache.httpcomponents.core5:httpcore5:5.2.4=classpath
+org.apache.maven.resolver:maven-resolver-api:1.9.18=classpath
+org.apache.maven.resolver:maven-resolver-impl:1.9.18=classpath
+org.apache.maven.resolver:maven-resolver-named-locks:1.9.18=classpath
+org.apache.maven.resolver:maven-resolver-spi:1.9.18=classpath
+org.apache.maven.resolver:maven-resolver-util:1.9.18=classpath
+org.apache.maven.shared:maven-shared-utils:3.3.4=classpath
+org.apache.maven:maven-artifact:3.9.6=classpath
+org.apache.maven:maven-builder-support:3.9.6=classpath
+org.apache.maven:maven-core:3.9.6=classpath
+org.apache.maven:maven-model-builder:3.9.6=classpath
+org.apache.maven:maven-model:3.9.6=classpath
+org.apache.maven:maven-plugin-api:3.9.6=classpath
+org.apache.maven:maven-repository-metadata:3.9.6=classpath
+org.apache.maven:maven-resolver-provider:3.9.6=classpath
+org.apache.maven:maven-settings-builder:3.9.6=classpath
+org.apache.maven:maven-settings:3.9.6=classpath
+org.codehaus.plexus:plexus-cipher:2.0=classpath
+org.codehaus.plexus:plexus-classworlds:2.7.0=classpath
+org.codehaus.plexus:plexus-component-annotations:2.1.0=classpath
+org.codehaus.plexus:plexus-interpolation:1.26=classpath
+org.codehaus.plexus:plexus-sec-dispatcher:2.0=classpath
+org.codehaus.plexus:plexus-utils:3.5.1=classpath
+org.codehaus.woodstox:stax2-api:4.2.1=classpath
+org.cyclonedx:cyclonedx-core-java:8.0.3=classpath
+org.cyclonedx:cyclonedx-gradle-plugin:1.8.2=classpath
 org.eclipse.jgit:org.eclipse.jgit:6.8.0.202311291450-r=classpath
-org.slf4j:slf4j-api:1.7.36=classpath
+org.eclipse.sisu:org.eclipse.sisu.inject:0.9.0.M2=classpath
+org.eclipse.sisu:org.eclipse.sisu.plexus:0.9.0.M2=classpath
+org.slf4j:slf4j-api:2.0.7=classpath
 org.springframework.boot:spring-boot-buildpack-platform:3.3.1=classpath
 org.springframework.boot:spring-boot-gradle-plugin:3.3.1=classpath
 org.springframework.boot:spring-boot-loader-tools:3.3.1=classpath
 org.springframework:spring-core:6.1.10=classpath
 org.springframework:spring-jcl:6.1.10=classpath
 org.tomlj:tomlj:1.0.0=classpath
+org.yaml:snakeyaml:2.1=classpath
 empty=

gradle/spring-boot.gradle

@@ -1,5 +1,6 @@
 apply plugin: 'org.springframework.boot'
 apply plugin: 'com.gorylenko.gradle-git-properties'
+apply plugin: 'org.cyclonedx.bom'
 
 ext.profiles = project.hasProperty('profiles') ? project.getProperty('profiles').split(',') : ['local'] // ./gradlew bootRun -Pprofiles=profileName