chore: building sbom (WPB-20668)

.github/workflows/build-unified.yml

@@ -245,6 +245,20 @@ jobs:
           path: app/build/outputs/
           retention-days: 7
 
+      - name: Generate SBOM
+        if: github.actor != 'dependabot[bot]'
+        continue-on-error: true
+        run: ./gradlew generateSbom
+
+      - name: Upload SBOM artifact
+        if: github.actor != 'dependabot[bot]'
+        continue-on-error: true
+        uses: actions/upload-artifact@v6
+        with:
+          name: sbom-${{ matrix.flavor }}-${{ matrix.variant }}
+          path: build/reports/cyclonedx/
+          retention-days: 30
+
       - name: Build summary
         run: |
           echo "## Build Summary" >> $GITHUB_STEP_SUMMARY

build.gradle.kts

@@ -49,11 +49,23 @@ allprojects {
         maven(url = "https://jitpack.io")
         maven(url = "https://oss.sonatype.org/content/repositories/snapshots")
     }
+    tasks.withType<org.cyclonedx.gradle.CyclonedxDirectTask>().configureEach {
+        includeConfigs.set(listOf(".*[Rr]untimeClasspath.*"))
+        skipConfigs.set(listOf(".*[Tt]est.*", ".*[Ll]int.*", ".*[Aa]nnotation.*", ".*[Kk]sp.*"))
+    }
 }
 
 plugins {
     id(ScriptPlugins.infrastructure)
     alias(libs.plugins.ksp) apply false // https://github.com/google/dagger/issues/3965
     alias(libs.plugins.compose.compiler) apply false
+    alias(libs.plugins.cyclonedx)
+}
+
+tasks.cyclonedxBom {
+    includeBomSerialNumber = true
+    includeLicenseText = false
+    componentName = "wire-android"
 }
 
+apply(from = "sbom.gradle.kts")

gradle/libs.versions.toml

@@ -87,6 +87,7 @@ openIdAppAuth = "0.11.1"
 
 # Other Tools
 aboutLibraries = "12.2.4"
+cyclonedx = "3.1.0"
 leakCanary = "2.14"
 ksp = "2.1.0-1.0.28"
 
@@ -128,6 +129,7 @@ aboutLibraries = { id = "com.mikepenz.aboutlibraries.plugin", version.ref = "abo
 ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" }
 screenshot = { id = "com.android.compose.screenshot", version.ref = "screenshot"}
 compose-compiler = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
+cyclonedx = { id = "org.cyclonedx.bom", version.ref = "cyclonedx" }
 
 # Home-made convention plugins defined in build-logic
 wire-android-application = { id = "com.wire.android.application" }

sbom.gradle.kts

@@ -0,0 +1,36 @@
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ */
+
+// SBOM generation: produces aggregate CycloneDX JSON output.
+// Plugin application and task configuration live in build.gradle.kts (requires plugin classpath).
+
+// Set meaningful versions on internal modules for SBOM traceability.
+// Without this, wire-android modules report "unspecified" in the BOM.
+val wireGitHash: Provider<String> = providers.exec {
+    commandLine("git", "rev-parse", "--short", "HEAD")
+}.standardOutput.asText.map { it.trim() }
+
+allprojects {
+    version = wireGitHash.get()
+}
+
+tasks.register("generateSbom") {
+    group = "reporting"
+    dependsOn("cyclonedxBom")
+    description = "Generate SBOM"
+}

settings.gradle.kts

@@ -19,6 +19,7 @@ rootProject.name = "wire-android"
 pluginManagement {
     includeBuild("build-logic")
     repositories {
+        gradlePluginPortal()
         mavenCentral()
         google()
          maven(url = "https://s01.oss.sonatype.org/content/repositories/snapshots")