Build: Refactor sbom configuration & wire it with main publication

buildSrc/build.gradle.kts

@@ -39,6 +39,10 @@ gradlePlugin {
             id = "jps-compatible"
             implementationClass = "org.jetbrains.kotlin.pill.JpsCompatiblePlugin"
         }
+        register("kotlin-build-publishing") {
+            id = "kotlin-build-publishing"
+            implementationClass = "plugins.KotlinBuildPublishingPlugin"
+        }
     }
 }
 

buildSrc/src/main/kotlin/artifacts.kt

@@ -380,7 +380,7 @@ fun Project.publishTestJar(projects: List<String>, excludedPaths: List<String>)
         }
     }
 
-    publish()
+    publish(sbom = false)
 
     val jar: Jar by tasks
 

buildSrc/src/main/kotlin/sbom.kt

@@ -1,25 +1,31 @@
-import org.gradle.api.Project
-import org.gradle.api.artifacts.PublishArtifact
-import org.gradle.kotlin.dsl.apply
-import org.gradle.kotlin.dsl.configure
-import org.spdx.sbom.gradle.SpdxSbomExtension
-import org.spdx.sbom.gradle.SpdxSbomPlugin
-import java.util.*
-
 /*
  * Copyright 2010-2023 JetBrains s.r.o. and Kotlin Programming Language contributors.
  * Use of this source code is governed by the Apache 2.0 license that can be found in the license/LICENSE.txt file.
  */
 
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.kotlin.dsl.*
+import org.spdx.sbom.gradle.SpdxSbomExtension
+import org.spdx.sbom.gradle.SpdxSbomPlugin
+import org.spdx.sbom.gradle.SpdxSbomTask
+import plugins.mainPublicationName
+import java.util.*
+
+
 fun Project.configureSbom(
-    moduleName: String = this.name,
+    target: String? = null,
-    gradleConfigurations: Iterable<String> = setOf("runtimeClasspath"),
+    documentName: String? = null,
-): PublishArtifact {
+    gradleConfigurations: Iterable<String> = setOf("runtimeClasspath")
+): TaskProvider<SpdxSbomTask> {
     val project = this
+    val targetName = target ?: "${mainPublicationName}Publication"
     apply<SpdxSbomPlugin>()
 
     configure<SpdxSbomExtension> {
-        targets.create(moduleName) {
+        targets.create(targetName) {
             configurations.set(gradleConfigurations)
             scm {
                 tool.set("git")
@@ -29,7 +35,7 @@ fun Project.configureSbom(
 
             // adjust properties of the document
             document {
-                this.name.set("SpdxDoc for $moduleName")
+                name.set(documentName ?: project.name)
                 // NOTE: The URI does not have to be accessible. It is only intended to provide a unique ID.
                 // In many cases, the URI will point to a Web accessible document, but this should not be assumed to be the case.
                 namespace.set("https://www.jetbrains.com/spdxdocs/${UUID.randomUUID()}")
@@ -39,17 +45,26 @@ fun Project.configureSbom(
         }
     }
 
-    val sbomCfg = configurations.maybeCreate("sbomFor$moduleName").apply {
+    val spdxSbomTask = tasks.named<SpdxSbomTask>("spdxSbomFor$targetName")
+    val sbomFile = spdxSbomTask.map { it.outputDirectory.file("$targetName.spdx.json") }
+
+    val sbomCfg = configurations.maybeCreate("sbomFor$targetName").apply {
         isCanBeResolved = false
         isCanBeConsumed = true
     }
-    val sbomFile = layout.buildDirectory.file("spdx/$moduleName.spdx.json")
+
-    val sbomArtifact = artifacts.add(sbomCfg.name, sbomFile.get().asFile) {
+    val sbomArtifact = artifacts.add(sbomCfg.name, sbomFile) {
         type = "sbom"
         extension = "spdx.json"
-        val capitalizedModuleName =
+        builtBy(spdxSbomTask)
-            moduleName.replaceFirstChar { if (it.isLowerCase()) it.titlecase(Locale.getDefault()) else it.toString() }
-        builtBy("spdxSbomFor$capitalizedModuleName")
     }
-    return sbomArtifact
+
+    if (target == null) {
+        pluginManager.withPlugin("kotlin-build-publishing") {
+            val mainPublication = the<PublishingExtension>().publications[mainPublicationName] as MavenPublication
+            mainPublication.artifact(sbomArtifact)
+        }
+    }
+
+    return spdxSbomTask
 }

libraries/commonConfiguration.gradle

@@ -56,8 +56,8 @@ ext.configurePublishing = { Project project, configure = { } ->
     }
 }
 
-ext.configureSbom = { Project project, String moduleName = project.name, Iterable<String> gradleConfigurations = ["runtimeClasspath"] ->
+ext.configureSbom = { Project project, String target = null, String documentTitle = null,  Iterable<String> gradleConfigurations = ["runtimeClasspath"] ->
-    SbomKt.configureSbom(project, moduleName, gradleConfigurations)
+    SbomKt.configureSbom(project, target, documentTitle, gradleConfigurations)
 }
 
 ext.configureFrontendIr = { Project project ->

libraries/stdlib/common/build.gradle

@@ -2,10 +2,8 @@ description = 'Kotlin Common Standard Library'
 
 apply plugin: 'kotlin-platform-common'
 
-def sbom = configureSbom(project)
+configureSbom(project)
-configurePublishing(project, {
+configurePublishing(project)
-    artifact(sbom)
-})
 
 JvmToolchain.updateJvmTarget(project, "1.8")
 

libraries/stdlib/jdk7/build.gradle

@@ -4,10 +4,8 @@ apply plugin: 'kotlin'
 
 JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8)
 
-def sbom = configureSbom(project)
+configureSbom(project)
-configurePublishing(project, {
+configurePublishing(project)
-    artifact(sbom)
-})
 configureSourcesJar()
 configureJavadocJar()
 

libraries/stdlib/jdk8/build.gradle

@@ -2,10 +2,8 @@ description = 'Kotlin Standard Library JDK 8 extension'
 
 apply plugin: 'kotlin'
 
-def sbom = configureSbom(project)
+configureSbom(project)
-configurePublishing(project, {
+configurePublishing(project)
-    artifact(sbom)
-})
 configureSourcesJar()
 configureJavadocJar()
 

libraries/stdlib/jvm/build.gradle

@@ -6,10 +6,8 @@ archivesBaseName = 'kotlin-stdlib'
 
 JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8)
 
-def sbom = configureSbom(project)
+configureSbom(project)
-configurePublishing(project, {
+configurePublishing(project)
-    artifact(sbom)
-})
 configureJavadocJar()
 configureSourcesJar()
 

prepare/compiler/build.gradle.kts

@@ -250,8 +250,16 @@ dependencies {
     fatJarContentsStripVersions(commonDependency("one.util:streamex")) { isTransitive = false }
 }
 
+configureSbom() // sbom for main maven publication
 publish()
 
+// sbom for dist
+val distSbomTask = configureSbom(
+    target = "Dist",
+    documentName = "Kotlin Compiler Distribution",
+    setOf(configurations.runtimeClasspath.name, libraries.name, librariesStripVersion.name, compilerPlugins.name)
+)
+
 val packCompiler by task<Jar> {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
     destinationDirectory.set(File(buildDir, "libs"))
@@ -430,12 +438,6 @@ val distJs = distTask<Sync>("distJs") {
     from(distJSContents)
 }
 
-val compilerZipSbomName = "kotlin-compiler-zip"
-val sbom = configureSbom(
-    moduleName = compilerZipSbomName,
-    gradleConfigurations = setOf("runtimeClasspath", libraries.name, librariesStripVersion.name, compilerPlugins.name)
-)
-
 distTask<Copy>("dist") {
     destinationDir = File(distDir)
 
@@ -443,12 +445,12 @@ distTask<Copy>("dist") {
     dependsOn(distCommon)
     dependsOn(distMaven)
     dependsOn(distJs)
-    dependsOn("spdxSbomForKotlin-compiler-zip")
+    dependsOn(distSbomTask)
 
     from(buildNumber)
     from(distStdlibMinimalForTests)
-    from(sbom.file) {
+    from(distSbomTask.map { it.outputDirectory.file("dist.spdx.json") }) {
-        rename("$compilerZipSbomName.spdx.json", "${project.name}-${project.version}.spdx.json")
+        rename(".*", "${project.name}-${project.version}.spdx.json")
     }
 }