From bbe5418a856d881ce255428c51fa4cb8ff441c65 Mon Sep 17 00:00:00 2001
From: Bogdan Mukvich <bogdan.mukvich@jetbrains.com>
Date: Tue, 9 May 2023 13:05:51 +0200
Subject: [PATCH] Add SBOM to dist compiler task

---
 buildSrc/src/main/kotlin/sbom.kt  | 19 ++++++++++++++++---
 prepare/compiler/build.gradle.kts |  5 +++--
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/buildSrc/src/main/kotlin/sbom.kt b/buildSrc/src/main/kotlin/sbom.kt
index 8730a5b259b..769e803ef87 100644
--- a/buildSrc/src/main/kotlin/sbom.kt
+++ b/buildSrc/src/main/kotlin/sbom.kt
@@ -1,9 +1,12 @@
 import org.gradle.api.Project
 import org.gradle.api.publish.PublishingExtension
 import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.tasks.Copy
 import org.gradle.kotlin.dsl.apply
 import org.gradle.kotlin.dsl.configure
 import org.gradle.kotlin.dsl.findByType
+
 import org.spdx.sbom.gradle.SpdxSbomExtension
 import org.spdx.sbom.gradle.SpdxSbomPlugin
 import plugins.mainPublicationName
@@ -14,7 +17,7 @@ import java.util.*
  * Use of this source code is governed by the Apache 2.0 license that can be found in the license/LICENSE.txt file.
  */
 
-fun Project.configureSbom(gradleConfigurations: Iterable<String> = setOf("runtimeClasspath")) {
+fun Project.configureSbom(gradleConfigurations: Iterable<String> = setOf("runtimeClasspath")): Configuration {
     val project = this
     apply<SpdxSbomPlugin>()
 
@@ -39,9 +42,12 @@ fun Project.configureSbom(gradleConfigurations: Iterable<String> = setOf("runtim
         }
     }
 
-    configurations.maybeCreate("sbom")
+    val sbomCfg = configurations.maybeCreate("sbom").apply {
+        isCanBeResolved = false
+        isCanBeConsumed = true
+    }
     val sbomFile = layout.buildDirectory.file("spdx/${project.name}.spdx.json")
-    val sbomArtifact = artifacts.add("sbom", sbomFile.get().asFile) {
+    val sbomArtifact = artifacts.add(sbomCfg.name, sbomFile.get().asFile) {
         type = "sbom"
         extension = "spdx.json"
         builtBy("spdxSbom")
@@ -52,4 +58,11 @@ fun Project.configureSbom(gradleConfigurations: Iterable<String> = setOf("runtim
     publication?.apply {
         artifact(sbomArtifact)
     }
+    return sbomCfg
 }
+
+fun Copy.fromSbom(sbom: Configuration) {
+    from(sbom.artifacts.files) {
+        rename("${project.name}.spdx.json", "${project.name}-${project.version}.spdx.json")
+    }
+}
\ No newline at end of file
diff --git a/prepare/compiler/build.gradle.kts b/prepare/compiler/build.gradle.kts
index 229b421030f..4af72bf8b74 100644
--- a/prepare/compiler/build.gradle.kts
+++ b/prepare/compiler/build.gradle.kts
@@ -395,6 +395,8 @@ val distJs = distTask<Sync>("distJs") {
     from(distJSContents)
 }
 
+val sbom = configureSbom(setOf("runtimeClasspath", libraries.name, librariesStripVersion.name, compilerPlugins.name))
+
 distTask<Copy>("dist") {
     destinationDir = File(distDir)
 
@@ -405,6 +407,7 @@ distTask<Copy>("dist") {
 
     from(buildNumber)
     from(distStdlibMinimalForTests)
+    fromSbom(sbom)
 }
 
 inline fun <reified T : AbstractCopyTask> Project.distTask(
@@ -416,5 +419,3 @@ inline fun <reified T : AbstractCopyTask> Project.distTask(
     rename(quote("-$bootstrapKotlinVersion"), "")
     block()
 }
-
-configureSbom(setOf("runtimeClasspath", libraries.name, librariesStripVersion.name, compilerPlugins.name))
\ No newline at end of file