Provide sbom (#8)

README.md

@@ -126,3 +126,5 @@ If you have any further questions, please contact us at [support@tracetronic.com
 This plugin is licensed under the terms of the [3-Clause BSD license](LICENSES/BSD-3-Clause.txt).
 
 Using the [REUSE helper tool](https://github.com/fsfe/reuse-tool), you can run `reuse spdx` to get a bill of materials.
+
+To generate a software bill of material (sbom) for the project run ```./gradlew cyclonedxBom```. The generated _sbom_ destination is ```build/reports/bom.json``` 

build.gradle

@@ -13,6 +13,7 @@ plugins {
     id 'org.jenkins-ci.jpi' version "$jpiVersion"
     id "org.openapi.generator" version "$openapiVersion"
     id "com.github.spotbugs" version "$spotBugsPlugin"
+    id 'org.cyclonedx.bom' version "$cyclondxVersion"
 }
 
 group = 'de.tracetronic.jenkins.plugins'
@@ -257,6 +258,10 @@ openApiGenerate {
     ]
 }
 
+cyclonedxBom {
+    outputFormat = "json"
+}
+
 sourceSets {
     main {
         java {

gradle.properties

@@ -6,6 +6,7 @@ gradleVersion=7.3
 openapiVersion=6.1.0
 spotBugsPlugin=5.0.13
 spotBugsVersion=4.7.3
+cyclondxVersion=1.7.2
 jenkinsTestHarnessVersion=1746.v2b_3c5d1983b_e
 # --- Disabling SHA256 and SHA512 checksums when releasing a plugin ---#
 # --- see https://github.com/jenkinsci/gradle-jpi-plugin/blob/master/README.md#disabling-sha256-and-sha512-checksums-when-releasing-a-plugin ---#