From 3a6f805d50fd7cb045b42761e9b2802c35428e18 Mon Sep 17 00:00:00 2001
From: airajena <airajena0@gmail.com>
Date: Sat, 17 Jan 2026 20:39:41 +0530
Subject: [PATCH] FINERACT-2164: Add Gradle SBOM (Software Bill of Materials)
 generator

- Add CycloneDX plugin for SBOM generation (version 3.1.0)
- Configure as optional task (not part of default build)
- Generate SBOM in CycloneDX format with license information
- Usage: ./gradlew :fineract-provider:cyclonedxDirectBom

Output: build/reports/cyclonedx-direct/bom.{json,xml}
---
 build.gradle | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/build.gradle b/build.gradle
index e38d5dce1..5f2d9d9ed 100644
--- a/build.gradle
+++ b/build.gradle
@@ -119,6 +119,7 @@ plugins {
     id 'org.openapi.generator' version '7.8.0' apply false
     id 'com.gradleup.shadow' version '8.3.5' apply false
     id 'me.champeau.jmh' version '0.7.1' apply false
+    id 'org.cyclonedx.bom' version '3.1.0' apply false
 }
 
 apply from: "${rootDir}/buildSrc/src/main/groovy/org.apache.fineract.release.gradle"
@@ -888,6 +889,16 @@ configure(project.fineractPublishProjects) {
     }
 }
 
+// Configuration for CycloneDX SBOM generator
+// https://github.com/CycloneDX/cyclonedx-gradle-plugin
+apply plugin: 'org.cyclonedx.bom'
+
+cyclonedxBom {
+    projectType = "application"
+    includeBomSerialNumber = true
+    includeLicenseText = true
+}
+
 task printSourceSetInformation() {
     doLast{
         sourceSets.each { srcSet ->