From 760c81c09cb65cfa7e731074b028b3dd6f754bbe Mon Sep 17 00:00:00 2001
From: Iliyan Velichkov <velichkov.iliyan@gmail.com>
Date: Mon, 9 Feb 2026 10:07:23 +0200
Subject: [PATCH] add sbom plugin - cyclonedx-maven-plugin

---
 pom.xml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/pom.xml b/pom.xml
index d14ca98..1174b7d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -212,6 +212,38 @@
 
         <pluginManagement>
             <plugins>
+                <plugin>
+                    <groupId>org.cyclonedx</groupId>
+                    <artifactId>cyclonedx-maven-plugin</artifactId>
+                    <version>2.9.1</version>
+                    <executions>
+                        <execution>
+                            <phase>prepare-package</phase>
+                            <goals>
+                                <goal>makeAggregateBom</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                    <configuration>
+                        <!--                        https://cyclonedx.org/docs/1.6/json/-->
+                        <schemaVersion>1.6</schemaVersion>
+                        <projectType>application</projectType>
+                        <verbose>false</verbose>
+
+                        <includeBomSerialNumber>true</includeBomSerialNumber>
+                        <includeCompileScope>true</includeCompileScope>
+                        <includeProvidedScope>true</includeProvidedScope>
+                        <includeRuntimeScope>true</includeRuntimeScope>
+                        <includeSystemScope>true</includeSystemScope>
+                        <includeTestScope>false</includeTestScope>
+                        <includeLicenseText>false</includeLicenseText>
+
+                        <outputReactorProjects>true</outputReactorProjects>
+                        <outputFormat>all</outputFormat>
+                        <outputName>bom</outputName>
+                        <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
+                    </configuration>
+                </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>