From acb97d8cc947dfc9ae8b6693c7e7f90eafe0c6c2 Mon Sep 17 00:00:00 2001
From: Bogdan Mukvich <bogdan.mukvich@jetbrains.com>
Date: Wed, 7 Jun 2023 17:24:46 +0200
Subject: [PATCH] Add SBOM for gradle plugins

^KTI-1273
---
 buildSrc/src/main/kotlin/GradleCommon.kt      | 27 ++++++++++++-------
 .../build.gradle                              |  2 +-
 .../build.gradle.kts                          |  2 +-
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/buildSrc/src/main/kotlin/GradleCommon.kt b/buildSrc/src/main/kotlin/GradleCommon.kt
index 76c63d382a2..2c5d55450b7 100644
--- a/buildSrc/src/main/kotlin/GradleCommon.kt
+++ b/buildSrc/src/main/kotlin/GradleCommon.kt
@@ -64,8 +64,10 @@ val commonSourceSetName = "common"
  * Configures common pom configuration parameters
  */
 fun Project.configureCommonPublicationSettingsForGradle(
-    signingRequired: Boolean
+    signingRequired: Boolean,
+    sbom: Boolean = true,
 ) {
+    val sbomTask = if (sbom) configureSbom() else null
     plugins.withId("maven-publish") {
         configureDefaultPublishing(signingRequired)
 
@@ -74,6 +76,12 @@ fun Project.configureCommonPublicationSettingsForGradle(
                 .withType<MavenPublication>()
                 .configureEach {
                     configureKotlinPomAttributes(project)
+
+                    if (sbomTask != null) {
+                        artifact(sbomTask.map { it.outputDirectory.file("MainPublication.spdx.json") }) {
+                            extension = "spdx.json"
+                        }
+                    }
                 }
         }
     }
@@ -168,7 +176,7 @@ fun Project.createGradleCommonSourceSet(): SourceSet {
  */
 private fun Project.fixWiredSourceSetSecondaryVariants(
     wireSourceSet: SourceSet,
-    commonSourceSet: SourceSet
+    commonSourceSet: SourceSet,
 ) {
     configurations
         .matching {
@@ -226,7 +234,7 @@ private fun Project.fixWiredSourceSetSecondaryVariants(
  */
 fun Project.wireGradleVariantToCommonGradleVariant(
     wireSourceSet: SourceSet,
-    commonSourceSet: SourceSet
+    commonSourceSet: SourceSet,
 ) {
     wireSourceSet.compileClasspath += commonSourceSet.output
     wireSourceSet.runtimeClasspath += commonSourceSet.output
@@ -269,7 +277,7 @@ private const val FIXED_CONFIGURATION_SUFFIX = "WithFixedAttribute"
  * 'main' sources are used for minimal supported Gradle versions (6.7) up to Gradle 7.0.
  */
 fun Project.reconfigureMainSourcesSetForGradlePlugin(
-    commonSourceSet: SourceSet
+    commonSourceSet: SourceSet,
 ) {
     sourceSets.named(SourceSet.MAIN_SOURCE_SET_NAME) {
         plugins.withType<JavaGradlePluginPlugin>().configureEach {
@@ -374,9 +382,10 @@ fun Project.reconfigureMainSourcesSetForGradlePlugin(
                         TargetJvmVersion.TARGET_JVM_VERSION_ATTRIBUTE
                     )
                     if (attributes.keySet() != expectedAttributes) {
-                        error("Wrong set of attributes:\n" +
-                                      "  Expected: ${expectedAttributes.joinToString(", ")}\n" +
-                                      "  Actual: ${attributes.keySet().joinToString(", ") { "${it.name}=${attributes.getAttribute(it)}" }}"
+                        error(
+                            "Wrong set of attributes:\n" +
+                                    "  Expected: ${expectedAttributes.joinToString(", ")}\n" +
+                                    "  Actual: ${attributes.keySet().joinToString(", ") { "${it.name}=${attributes.getAttribute(it)}" }}"
                         )
                     }
 
@@ -418,7 +427,7 @@ fun Project.reconfigureMainSourcesSetForGradlePlugin(
 fun Project.createGradlePluginVariant(
     variant: GradlePluginVariant,
     commonSourceSet: SourceSet,
-    isGradlePlugin: Boolean = true
+    isGradlePlugin: Boolean = true,
 ): SourceSet {
     val variantSourceSet = sourceSets.create(variant.sourceSetName) {
         excludeGradleCommonDependencies(this)
@@ -539,7 +548,7 @@ fun Project.configureKotlinCompileTasksGradleCompatibility() {
 // Will allow combining outputs of multiple SourceSets
 fun Project.publishShadowedJar(
     sourceSet: SourceSet,
-    commonSourceSet: SourceSet
+    commonSourceSet: SourceSet,
 ) {
     val jarTask = tasks.named<Jar>(sourceSet.jarTaskName)
 
diff --git a/libraries/examples/kotlin-gradle-subplugin-example/build.gradle b/libraries/examples/kotlin-gradle-subplugin-example/build.gradle
index 057e41b1ef8..5c575b8b392 100644
--- a/libraries/examples/kotlin-gradle-subplugin-example/build.gradle
+++ b/libraries/examples/kotlin-gradle-subplugin-example/build.gradle
@@ -35,7 +35,7 @@ dependencies {
     compileOnly project(':dependencies:intellij-core')
 }
 
-GradleCommonKt.configureCommonPublicationSettingsForGradle(project, false)
+GradleCommonKt.configureCommonPublicationSettingsForGradle(project, false, false)
 GradleCommonKt.configureKotlinCompileTasksGradleCompatibility(project)
 GradleCommonKt.excludeGradleCommonDependencies(project, sourceSets.main)
 TasksKt.optInToExperimentalCompilerApi(project)
diff --git a/libraries/tools/kotlin-gradle-plugins-bom/build.gradle.kts b/libraries/tools/kotlin-gradle-plugins-bom/build.gradle.kts
index 36f288f5d10..0bce50d7d29 100644
--- a/libraries/tools/kotlin-gradle-plugins-bom/build.gradle.kts
+++ b/libraries/tools/kotlin-gradle-plugins-bom/build.gradle.kts
@@ -26,7 +26,7 @@ dependencies {
     }
 }
 
-configureCommonPublicationSettingsForGradle(signLibraryPublication)
+configureCommonPublicationSettingsForGradle(signLibraryPublication, sbom = false)
 
 publishing {
     publications {