Add SBOM configuration for all published artifacts by default

buildSrc/src/main/kotlin/artifacts.kt

@@ -8,14 +8,13 @@ import org.gradle.api.artifacts.Configuration
 import org.gradle.api.artifacts.ConfigurationContainer
 import org.gradle.api.artifacts.PublishArtifact
 import org.gradle.api.artifacts.component.ProjectComponentIdentifier
-import org.gradle.api.attributes.LibraryElements
-import org.gradle.api.attributes.Usage
 import org.gradle.api.component.AdhocComponentWithVariants
 import org.gradle.api.file.ArchiveOperations
 import org.gradle.api.file.DuplicatesStrategy
 import org.gradle.api.plugins.BasePluginExtension
 import org.gradle.api.plugins.JavaPlugin
-import org.gradle.api.plugins.JavaPlugin.*
+import org.gradle.api.plugins.JavaPlugin.JAVADOC_ELEMENTS_CONFIGURATION_NAME
+import org.gradle.api.plugins.JavaPlugin.SOURCES_ELEMENTS_CONFIGURATION_NAME
 import org.gradle.api.plugins.JavaPluginExtension
 import org.gradle.api.provider.Provider
 import org.gradle.api.publish.PublishingExtension
@@ -271,7 +270,7 @@ fun Project.standardPublicJars() {
     javadocJar()
 }
 
-fun Project.publish(moduleMetadata: Boolean = false, configure: MavenPublication.() -> Unit = { }) {
+fun Project.publish(moduleMetadata: Boolean = false, sbom: Boolean = true, configure: MavenPublication.() -> Unit = { }) {
     apply<KotlinBuildPublishingPlugin>()
 
     if (!moduleMetadata) {
@@ -284,6 +283,9 @@ fun Project.publish(moduleMetadata: Boolean = false, configure: MavenPublication
         ?.publications
         ?.findByName(mainPublicationName) as MavenPublication
     publication.configure()
+    if (sbom) {
+        configureSbom()
+    }
 }
 
 fun Project.idePluginDependency(block: () -> Unit) {

buildSrc/src/main/kotlin/sbom.kt

@@ -46,8 +46,7 @@ fun Project.configureSbom(
     }
 
     val spdxSbomTask = tasks.named<SpdxSbomTask>("spdxSbomFor$targetName")
-    val sbomFile = spdxSbomTask.map { it.outputDirectory.file("$targetName.spdx.json") }
-
+    val sbomFile = layout.buildDirectory.file("spdx/$targetName.spdx.json")
     val sbomCfg = configurations.maybeCreate("sbomFor$targetName").apply {
         isCanBeResolved = false
         isCanBeConsumed = true

libraries/commonConfiguration.gradle

@@ -50,7 +50,7 @@ task preparePublication {
 }
 
 ext.configurePublishing = { Project project, configure = { } ->
-    ArtifactsKt.publish(project, false) { publication ->
+    ArtifactsKt.publish(project, false, false) { publication ->
         configure.delegate = publication
         configure()
     }

libraries/stdlib/common/build.gradle

@@ -2,7 +2,6 @@ description = 'Kotlin Common Standard Library'
 
 apply plugin: 'kotlin-platform-common'
 
-configureSbom(project)
 configurePublishing(project)
 
 JvmToolchain.updateJvmTarget(project, "1.8")

libraries/stdlib/jdk7/build.gradle

@@ -4,7 +4,6 @@ apply plugin: 'kotlin'
 
 JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8)
 
-configureSbom(project)
 configurePublishing(project)
 configureSourcesJar()
 configureJavadocJar()

libraries/stdlib/jdk8/build.gradle

@@ -2,7 +2,6 @@ description = 'Kotlin Standard Library JDK 8 extension'
 
 apply plugin: 'kotlin'
 
-configureSbom(project)
 configurePublishing(project)
 configureSourcesJar()
 configureJavadocJar()

libraries/stdlib/jvm/build.gradle

@@ -6,7 +6,6 @@ archivesBaseName = 'kotlin-stdlib'
 
 JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8)
 
-configureSbom(project)
 configurePublishing(project)
 configureJavadocJar()
 configureSourcesJar()

libraries/stdlib/wasm/build.gradle.kts

@@ -155,7 +155,7 @@ val compileTestDevelopmentExecutableKotlinWasm = tasks.named<KotlinJsIrLink>("co
 val runtimeElements by configurations.creating {}
 val apiElements by configurations.creating {}
 
-publish {
+publish(sbom = false) {
     pom.packaging = "klib"
     artifact(tasks.named("wasmJar")) {
         extension = "klib"

libraries/tools/kotlin-test-js-runner/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
     id("com.github.node-gradle.node") version "3.2.1"
 }
 
-publish()
+publish(sbom = false)
 
 val default = configurations.getByName(Dependency.DEFAULT_CONFIGURATION)
 default.extendsFrom(configurations.publishedRuntime.get())

prepare/compiler/build.gradle.kts

@@ -250,7 +250,6 @@ dependencies {
     fatJarContentsStripVersions(commonDependency("one.util:streamex")) { isTransitive = false }
 }
 
-configureSbom() // sbom for main maven publication
 publish()
 
 // sbom for dist
@@ -449,7 +448,7 @@ distTask<Copy>("dist") {
 
     from(buildNumber)
     from(distStdlibMinimalForTests)
-    from(distSbomTask.map { it.outputDirectory.file("dist.spdx.json") }) {
+    from(distSbomTask.map { it.outputDirectory.file("Dist.spdx.json") }) {
         rename(".*", "${project.name}-${project.version}.spdx.json")
     }
 }