Add SBOM support

Closes gh-1480

start-site/src/main/java/io/spring/start/site/extension/dependency/sbom/SbomCycloneDxBuildCustomizer.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.start.site.extension.dependency.sbom;
+
+import io.spring.initializr.generator.buildsystem.Build;
+import io.spring.initializr.generator.spring.build.BuildCustomizer;
+
+import org.springframework.core.Ordered;
+
+/**
+ * {@link BuildCustomizer} that removes the CycloneDX SBOM dependency as SBOM support does
+ * not require any dependency.
+ *
+ * @author Moritz Halbritter
+ */
+class SbomCycloneDxBuildCustomizer implements BuildCustomizer<Build> {
+
+	@Override
+	public void customize(Build build) {
+		build.dependencies().remove("sbom-cyclone-dx");
+	}
+
+	@Override
+	public int getOrder() {
+		return Ordered.LOWEST_PRECEDENCE - 10;
+	}
+
+}

start-site/src/main/java/io/spring/start/site/extension/dependency/sbom/SbomCycloneDxGradleBuildCustomizer.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.start.site.extension.dependency.sbom;
+
+import io.spring.initializr.generator.buildsystem.gradle.GradleBuild;
+import io.spring.initializr.generator.spring.build.BuildCustomizer;
+
+/**
+ * {@link BuildCustomizer} that adds the CycloneDX Gradle plugin.
+ *
+ * @author Moritz Halbritter
+ */
+class SbomCycloneDxGradleBuildCustomizer implements BuildCustomizer<GradleBuild> {
+
+	private static final String PLUGIN_VERSION = "1.8.2";
+
+	@Override
+	public void customize(GradleBuild build) {
+		build.plugins().add("org.cyclonedx.bom", (plugin) -> plugin.setVersion(PLUGIN_VERSION));
+	}
+
+}

start-site/src/main/java/io/spring/start/site/extension/dependency/sbom/SbomCycloneDxMavenBuildCustomizer.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.start.site.extension.dependency.sbom;
+
+import io.spring.initializr.generator.buildsystem.maven.MavenBuild;
+import io.spring.initializr.generator.spring.build.BuildCustomizer;
+
+/**
+ * {@link BuildCustomizer} that adds the CycloneDX Maven plugin.
+ *
+ * @author Moritz Halbritter
+ */
+class SbomCycloneDxMavenBuildCustomizer implements BuildCustomizer<MavenBuild> {
+
+	@Override
+	public void customize(MavenBuild build) {
+		build.plugins().add("org.cyclonedx", "cyclonedx-maven-plugin");
+	}
+
+}

start-site/src/main/java/io/spring/start/site/extension/dependency/sbom/SbomProjectGenerationConfiguration.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.start.site.extension.dependency.sbom;
+
+import io.spring.initializr.generator.buildsystem.gradle.GradleBuildSystem;
+import io.spring.initializr.generator.buildsystem.maven.MavenBuildSystem;
+import io.spring.initializr.generator.condition.ConditionalOnBuildSystem;
+import io.spring.initializr.generator.condition.ConditionalOnRequestedDependency;
+import io.spring.initializr.generator.project.ProjectGenerationConfiguration;
+
+import org.springframework.context.annotation.Bean;
+
+/**
+ * {@link ProjectGenerationConfiguration} for generation of projects that use SBOMs.
+ *
+ * @author Moritz Halbritter
+ */
+@ProjectGenerationConfiguration
+@ConditionalOnRequestedDependency("sbom-cyclone-dx")
+class SbomProjectGenerationConfiguration {
+
+	@Bean
+	SbomCycloneDxBuildCustomizer sbomBuildCustomizer() {
+		return new SbomCycloneDxBuildCustomizer();
+	}
+
+	@Bean
+	@ConditionalOnBuildSystem(MavenBuildSystem.ID)
+	SbomCycloneDxMavenBuildCustomizer sbomCycloneDxMavenBuildCustomizer() {
+		return new SbomCycloneDxMavenBuildCustomizer();
+	}
+
+	@Bean
+	@ConditionalOnBuildSystem(GradleBuildSystem.ID)
+	SbomCycloneDxGradleBuildCustomizer sbomCycloneDxGradleBuildCustomizer() {
+		return new SbomCycloneDxGradleBuildCustomizer();
+	}
+
+}

start-site/src/main/java/io/spring/start/site/extension/dependency/sbom/package-info.java

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Extensions for generation of projects that use SBOMs.
+ */
+package io.spring.start.site.extension.dependency.sbom;

start-site/src/main/resources/META-INF/spring.factories

@@ -23,6 +23,7 @@ io.spring.start.site.extension.dependency.oracle.OracleProjectGenerationConfigur
 io.spring.start.site.extension.dependency.postgresql.PgVectorProjectGenerationConfiguration,\
 io.spring.start.site.extension.dependency.postgresql.PostgresqlProjectGenerationConfiguration,\
 io.spring.start.site.extension.dependency.redis.RedisProjectGenerationConfiguration,\
+io.spring.start.site.extension.dependency.sbom.SbomProjectGenerationConfiguration,\
 io.spring.start.site.extension.dependency.solace.SolaceProjectGenerationConfiguration,\
 io.spring.start.site.extension.dependency.springamqp.SpringAmqpProjectGenerationConfiguration,\
 io.spring.start.site.extension.dependency.springazure.SpringAzureProjectGenerationConfiguration,\

start-site/src/main/resources/application.yml

@@ -898,6 +898,16 @@ initializr:
               description: Building a RESTful Web Service with Spring Boot Actuator
             - rel: reference
               href: https://docs.spring.io/spring-boot/docs/{bootVersion}/reference/htmlsingle/index.html#actuator
+        - name: CycloneDX SBOM support
+          id: sbom-cyclone-dx
+          description: Creates a Software Bill of Materials in CycloneDX format.
+          groupId: org.springframework.boot
+          artifactId: spring-boot
+          starter: false
+          compatibilityRange: "3.3.0"
+          links:
+            - rel: reference
+              href: https://docs.spring.io/spring-boot/reference/actuator/endpoints.html#actuator.endpoints.sbom
         - name: codecentric's Spring Boot Admin (Client)
           id: codecentric-spring-boot-admin-client
           groupId: de.codecentric

start-site/src/test/java/io/spring/start/site/extension/dependency/sbom/SbomProjectGenerationConfigurationTests.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright 2012-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.start.site.extension.dependency.sbom;
+
+import io.spring.initializr.web.project.ProjectRequest;
+import io.spring.start.site.extension.AbstractExtensionTests;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link SbomProjectGenerationConfiguration}.
+ *
+ * @author Moritz Halbritter
+ */
+class SbomProjectGenerationConfigurationTests extends AbstractExtensionTests {
+
+	@Test
+	void shouldNotAddGradlePluginIfSbomIsNotSelected() {
+		ProjectRequest request = createProjectRequest("web");
+		assertThat(gradleBuild(request)).doesNotContain("org.cyclonedx.bom");
+	}
+
+	@Test
+	void shouldNotAddMavenPluginIfSbomIsNotSelected() {
+		ProjectRequest request = createProjectRequest("web");
+		assertThat(mavenPom(request)).doesNotContain("cyclonedx-maven-plugin");
+	}
+
+	@Test
+	void shouldRemoveArtificalDependency() {
+		ProjectRequest request = createProjectRequest("sbom-cyclone-dx");
+		assertThat(mavenPom(request)).doesNotHaveDependency("org.springframework.boot", "spring-boot");
+		assertThat(gradleBuild(request)).doesNotContain("'org.springframework.boot:spring-boot'");
+	}
+
+	@Test
+	void shouldAddMavenPlugin() {
+		ProjectRequest request = createProjectRequest("sbom-cyclone-dx");
+		assertThat(mavenPom(request)).lines().containsSequence(
+		// @formatter:off
+			"			<plugin>",
+			"				<groupId>org.cyclonedx</groupId>",
+			"				<artifactId>cyclonedx-maven-plugin</artifactId>",
+			"			</plugin>"
+        // @formatter:on
+		);
+	}
+
+	@Test
+	void shouldAddGradlePlugin() {
+		ProjectRequest request = createProjectRequest("sbom-cyclone-dx");
+		assertThat(gradleBuild(request)).hasPlugin("org.cyclonedx.bom", "1.8.2");
+	}
+
+}