generate and upload sbom. closes #30

.gitlab-ci.yml

+include:
+  - template: Container-Scanning.gitlab-ci.yml
+  - project: 'dariah-de/gitlab-templates'
+    ref: 'main'
+    file: '/templates/SBOM-Upload.gitlab-ci.yml'
+
 variables:
   # This will suppress any download for dependencies and plugins or upload messages which would clutter the console log.
   # `showDateTime` will show the passed time in milliseconds. You need to specify `--batch-mode` to make this work.
@@ -90,10 +96,12 @@ build_and_deploy:
     - git -C src/main/webapp/tei-stylesheets/ checkout $TEI_STYLESHEETS_VERSION
     # REMOVE SKIPTESTS AS SOON AS TESTS ARE WORKING...!!
     - mvn $MAVEN_OPTS $MAVEN_CLI_OPTS $MAVEN_DEPLOY_OPTS -U clean verify -Ptextgrid.deb -DskipTests=true
+    - cp target/bom.json .
   artifacts:
     name: WEBAPP_DEB_PACKAGES
     paths:
       - ./target/*.deb
+      - bom.json
       
 build_container_image:
   image:

pom.xml

@@ -33,7 +33,8 @@
 		<saxon-version>9.5.1-5</saxon-version> <!-- XXX mind dependency from epubcheck -->
 		<cxf-version>2.7.18</cxf-version>
 		<confclient-version>4.1.0</confclient-version>
-		<tgsearch-version>4.0.1</tgsearch-version>
+		<cyclonedx-maven-plugin.version>2.7.0</cyclonedx-maven-plugin.version>
+		<tgsearch-version>4.0.3</tgsearch-version>
 		<tgcrud-version>2.6.0</tgcrud-version>
 		<!-- TG-crud client configuration is not working with newest crud, I'll
 			just fix it tomorrow! -->
@@ -198,6 +199,8 @@
 			<version>${xmlunit-version}</version>
 			<scope>test</scope>
 		</dependency>
+
+
 	</dependencies>
 
 	<build>
@@ -451,6 +454,22 @@
 					</reportPlugins>
 				</configuration>
 			</plugin>
+			<plugin>
+				<groupId>org.cyclonedx</groupId>
+				<artifactId>cyclonedx-maven-plugin</artifactId>
+				<version>${cyclonedx-maven-plugin.version}</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>makeAggregateBom</goal>
+						</goals>
+					</execution>
+				</executions>
+				<configuration>
+					<outputFormat>JSON</outputFormat>
+				</configuration>
+			</plugin>
 		</plugins>
 		<resources>
 			<resource>