From fc5b1b881648c5d9054bebe1b2381e6893b197f3 Mon Sep 17 00:00:00 2001
From: Alexey Loubyansky <olubyans@redhat.com>
Date: Fri, 12 Jun 2026 16:47:21 +0200
Subject: [PATCH] ARTEMIS-6209 Generate and bundle an SBOM inside
 artemis-console WAR

---
 .gitignore                                    |  3 ++
 .../artemis-extension/package.json            |  2 +-
 artemis-console-extension/pom.xml             | 36 +++++++++++++++++++
 artemis-console-war/pom.xml                   | 35 ++++++++++++++++++
 pom.xml                                       |  5 +++
 5 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 2b42ed73..81d57b90 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,9 @@ artemis-console-extension/artemis-extension/node/**/*
 artemis-console-extension/artemis-extension/packages/artemis-console-plugin/node_modules/
 artemis-console-extension/artemis-extension/app/node_modules/**/*
 
+# generated SBOM
+artemis-console-extension/artemis-extension/bom.cdx.json
+
 # yarn (zero-installs)
 artemis-console-extension/artemis-extension/.yarn/install-state.gz
 .yarn/**
diff --git a/artemis-console-extension/artemis-extension/package.json b/artemis-console-extension/artemis-extension/package.json
index 4ce5006f..ab3d6d05 100644
--- a/artemis-console-extension/artemis-extension/package.json
+++ b/artemis-console-extension/artemis-extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "artemis-console-monorepo",
-  "version": "0",
+  "version": "0.0.0",
   "description": "Artemis Console Monorepo",
   "license": "Apache-2.0",
   "private": true,
diff --git a/artemis-console-extension/pom.xml b/artemis-console-extension/pom.xml
index 518ccf6a..4cbb133a 100644
--- a/artemis-console-extension/pom.xml
+++ b/artemis-console-extension/pom.xml
@@ -78,6 +78,36 @@
                             <arguments>yarn build</arguments>
                         </configuration>
                     </execution>
+                    <!--
+                        Generate a CycloneDX SBOM for all npm dependencies
+                        using the official CycloneDX Yarn plugin. Resolves
+                        licenses from package.json in node_modules.
+                    -->
+                    <execution>
+                        <id>generate-sbom</id>
+                        <goals>
+                            <goal>corepack</goal>
+                        </goals>
+                        <configuration>
+                            <arguments>yarn workspace artemis-console-app dlx @cyclonedx/yarn-plugin-cyclonedx@3.3.3 --spec-version 1.6 --output-file ../bom.cdx.json</arguments>
+                        </configuration>
+                    </execution>
+                    <!--
+                        Enrich the SBOM:
+                        - add SHA-512 hashes from yarn.lock;
+                        - add evidence.identity;
+                        - -prod-only excludes non-production dependencies entirely;
+                        - omitting -prod-only sets scope=excluded for non-prod dependencies.
+                    -->
+                    <execution>
+                        <id>enrich-sbom</id>
+                        <goals>
+                            <goal>corepack</goal>
+                        </goals>
+                        <configuration>
+                            <arguments>yarn dlx @cyberstamp/cdx-npm-enrich@${cdx-npm-enrich-version} --prod-only bom.cdx.json</arguments>
+                        </configuration>
+                    </execution>
                     <execution>
                         <id>yarn test</id>
                         <goals>
@@ -117,6 +147,12 @@
                             </includes>
                             <followSymlinks>false</followSymlinks>
                         </fileset>
+                        <fileset>
+                            <directory>${basedir}/${extension.path}</directory>
+                            <includes>
+                                <include>bom.cdx.json</include>
+                            </includes>
+                        </fileset>
                     </filesets>
                 </configuration>
             </plugin>
diff --git a/artemis-console-war/pom.xml b/artemis-console-war/pom.xml
index 1cb07433..17ae5614 100644
--- a/artemis-console-war/pom.xml
+++ b/artemis-console-war/pom.xml
@@ -76,6 +76,15 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-war-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>prepare-war</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>exploded</goal>
+                        </goals>
+                    </execution>
+                </executions>
                 <configuration>
                 <nonFilteredFileExtensions>
                     <!-- default value contains jpg,jpeg,gif,bmp,png -->
@@ -92,10 +101,36 @@
                                 <include>**/*.*</include>
                             </includes>
                         </resource>
+                        <resource>
+                            <filtering>false</filtering>
+                            <directory>${project.build.directory}</directory>
+                            <targetPath>META-INF/sbom</targetPath>
+                            <includes>
+                                <include>bom.cdx.json</include>
+                            </includes>
+                        </resource>
                     </webResources>
                 </configuration>
             </plugin>
 
+            <plugin>
+                <groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
+                <artifactId>assembly-sbom-maven-plugin</artifactId>
+                <version>${assembly-sbom-maven-plugin-version}</version>
+                <executions>
+                    <execution>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>generate</goal>
+                        </goals>
+                        <configuration>
+                            <externalSboms>${project.basedir}/../artemis-console-extension/artemis-extension/bom.cdx.json</externalSboms>
+                            <outputFile>${project.build.directory}/bom.cdx.json</outputFile>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <groupId>org.eclipse.jetty.ee11</groupId>
                 <artifactId>jetty-ee11-maven-plugin</artifactId>
diff --git a/pom.xml b/pom.xml
index 01cf11de..680db4c2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,6 +55,8 @@
         <node-version>v22.23.1</node-version>
         <yarn-version>v4.9.2</yarn-version>
         <frontend-maven-plugin-version>1.15.1</frontend-maven-plugin-version>
+        <assembly-sbom-maven-plugin-version>0.1.4</assembly-sbom-maven-plugin-version>
+        <cdx-npm-enrich-version>0.1.6</cdx-npm-enrich-version>
         <project.build.outputTimestamp>2026-04-27T13:23:57Z</project.build.outputTimestamp>
     </properties>
 
@@ -244,6 +246,9 @@
                             <exclude>**/tsconfig.json</exclude>
                             <exclude>**/artemis-extension/app/build/**</exclude>
                             <exclude>**/artemis-extension/packages/artemis-console-plugin/dist/**</exclude>
+
+                            <!-- Generated SBOM -->
+                            <exclude>**/bom.cdx.json</exclude>
                         </excludes>
                     </configuration>
                 </plugin>