Merge pull request #43 from OneLiteFeatherNET/feature/cycloneDX

feature: add cyclonedx usage and bom publishing

Author: theEvilReaper

.github/workflows/publish.yml

@@ -21,4 +21,23 @@ jobs:
       - name: Build with Gradle
         run: ./gradlew build
       - name: Publish to Maven
-        run: ./gradlew publish
+        run: ./gradlew publish
+      - name: Generate CycloneDX BOM
+        run: ./gradlew cyclonedxBom
+      - name: Strip leading v from tag
+        if: startsWith(github.ref, 'refs/tags/')
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+      - run: |
+          echo "Version: $VERSION"
+        name: Display Version
+      - name: Upload BOM to Dependency-Track
+        uses: DependencyTrack/gh-upload-sbom@v3
+        with:
+          serverhostname: ${{ secrets.DEPENDENCYTRACK_HOSTNAME }}
+          apikey: ${{ secrets.DEPENDENCYTRACK_APIKEY }}
+          projectname: "Vulpes Base"
+          projectversion: ${{ env.VERSION }}
+          projecttags: 'java,minestom'
+          bomfilename: "build/reports/cyclonedx/bom.xml"
+          autocreate: true
+          parent: 'b82ab979-123b-4b6a-a9db-494ab852eebb'

build.gradle.kts

@@ -3,6 +3,7 @@ plugins {
     `java-library`
     `maven-publish`
     alias(libs.plugins.shadow)
+    alias(libs.plugins.cyclonedx)
 }
 
 group = "net.onelitefeather"

settings.gradle.kts

@@ -26,6 +26,7 @@ dependencyResolutionManagement {
             version("shadow", "9.3.0")
             version("bom", "1.6.0")
             version("worldSeed", "11.5.5")
+            version("cyclonedx", "3.0.1")
 
             library("mycelium.bom", "net.onelitefeather", "mycelium-bom").versionRef("bom")
             library("minestom", "net.minestom", "minestom").withoutVersion()
@@ -39,6 +40,7 @@ dependencyResolutionManagement {
             library("worldSeed", "net.worldseed.multipart", "WorldSeedEntityEngine").versionRef("worldSeed")
 
             plugin("shadow", "com.gradleup.shadow").versionRef("shadow")
+            plugin("cyclonedx", "org.cyclonedx.bom").versionRef("cyclonedx")
         }
     }
 }