React to CycloneDX Gradle Plugin application about spring-boot

[scottfrederick]

Thanks for trying out the new SBOM support @ciscoo.

The Spring Boot Gradle plugin should respond to the CycloneDX plugin and put the SBOM file in the appropriate location without additional configuration (see https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/CycloneDxPluginAction.java).

Can you give more details about the Gradle tasks you are running to generate the Spring Boot jar file that includes the SBOM, and share an example project with a build configuration that does not work as you expect?

[scottfrederick]

We should consider adding the CycloneDX plugin to the Reacting to Other Plugins section of the Spring Boot Gradle plugin documentation.

[ciscoo]

@scottfrederick I had missed that part.

I see that the SBOM JSON file is included in the final archive (bootJar), but I had expected it to also be available when running the application locally without building the final archive.

In other words, I expected ./gradlew bootRun to also include the generated SBOM so I can view that locally, but it doesn't

I guess maybe that is something to callout or document.