Add a configuration option to skip undeployed artifacts

This adds a `<skipNotDeployed>` plugin configuration option. If set to
`false`, even artifacts that do not have a deploy execution are used to
generate the SBOM.

Closes #430

Signed-off-by: Piotr P. Karwasz <piotr.github@karwasz.org>

src/it/makeAggregateBom/skipped/deploy-config-force/pom.xml

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>deploy-config-force</artifactId>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <configuration>
+ <skipNotDeployed>false</skipNotDeployed>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-deploy-plugin</artifactId>
+ <version>3.1.1</version>
+ <configuration>
+ <skip>true</skip>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+</project>

src/it/makeAggregateBom/skipped/deploy-property-force/pom.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>deploy-property-force</artifactId>
+
+ <properties>
+ <maven.deploy.skip>true</maven.deploy.skip>
+ <cyclonedx.skipNotDeployed>false</cyclonedx.skipNotDeployed>
+ </properties>
+</project>

src/it/makeAggregateBom/skipped/pom.xml

@@ -31,7 +31,9 @@
 
  <modules>
  <module>deploy-property</module>
+ <module>deploy-property-force</module>
  <module>deploy-config</module>
+ <module>deploy-config-force</module>
  <module>nexus-property</module>
  <module>nexus-config</module>
  </modules>

src/it/makeAggregateBom/verify.groovy

@@ -30,6 +30,8 @@ assertBomFiles("impls/target/bom", false)
 assertBomFiles("impls/impl-A/target/bom", false)
 assertBomFiles("impls/impl-B/target/bom", false)
 assertBomFiles("skipped/target/bom", false)
+assertBomFiles("skipped/deploy-config-force/target/bom", false)
+assertBomFiles("skipped/deploy-property-force/target/bom", false)
 
 assertNoBomFiles("skipped/deploy-config/target/bom")
 assertNoBomFiles("skipped/deploy-property/target/bom")
@@ -38,16 +40,16 @@ assertNoBomFiles("skipped/nexus-property/target/bom")
 
 var buildLog = new File(basedir, "build.log").text
 
-assert 13 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Dependencies/).size()
+assert 17 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Dependencies/).size()
 assert 2 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Aggregated Dependencies/).size()
 
-// 15 = 7 modules for main cyclonedx-makeAggregateBom execution
+// 19 = 9 modules for main cyclonedx-makeAggregateBom execution
 // + 1 for root module cyclonedx-makeAggregateBom-root-only execution
-// + 7 modules for additional cyclonedx-makeBom execution
-assert 15 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(XML\)/).size()
-assert 15 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(JSON\)/).size()
-// cyclonedx-makeAggregateBom-root-only execution skips 5 non-root modules
-assert 6 == (buildLog =~ /\[INFO\] Skipping CycloneDX on non-execution root/).size()
+// + 9 modules for additional cyclonedx-makeBom execution
+assert 19 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(XML\)/).size()
+assert 19 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(JSON\)/).size()
+// cyclonedx-makeAggregateBom-root-only execution skips 7 non-root modules
+assert 8 == (buildLog =~ /\[INFO\] Skipping CycloneDX on non-execution root/).size()
 
 // [WARNING] artifact org.cyclonedx.its:api:xml:cyclonedx:1.0-SNAPSHOT already attached, replace previous instance
 assert 0 == (buildLog =~ /-SNAPSHOT already attached, replace previous instance/).size()
@@ -72,6 +74,8 @@ assertBomEqualsNonAggregate("util/target/bom")
 assertBomEqualsNonAggregate("impls/target/bom")
 assertBomEqualsNonAggregate("impls/impl-A/target/bom")
 assertBomEqualsNonAggregate("impls/impl-B/target/bom")
+assertBomEqualsNonAggregate("skipped/deploy-config-force/target/bom")
+assertBomEqualsNonAggregate("skipped/deploy-property-force/target/bom")
 
 // dependencies for root component in makeAggregateBom is the list of modules
 String bom = new File(basedir, 'target/bom.xml').text

src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java

@@ -278,9 +278,18 @@ protected boolean shouldSkip() {
  return Boolean.parseBoolean(System.getProperty("cyclonedx.skip", Boolean.toString(skip)));
  }
 
+ protected String getSkipReason() {
+ return null;
+ }
+
  public void execute() throws MojoExecutionException {
  if (shouldSkip()) {
- getLog().info("Skipping CycloneDX");
+ final String skipReason = getSkipReason();
+ if (skipReason != null) {
+ getLog().info("Skipping CycloneDX goal, because " + skipReason);
+ } else {
+ getLog().info("Skipping CycloneDX goal");
+ }
  return;
  }
  logParameters();
@@ -490,7 +499,7 @@ protected void populateComponents(final Set<String> topLevelComponents, final Ma
  *
  * @return Component.Scope - REQUIRED, OPTIONAL or null if it cannot be determined
  *
- * @see detectUnusedForOptionalScope
+ * @see #detectUnusedForOptionalScope
  */
  private Component.Scope getComponentScope(Artifact artifact, ProjectDependencyAnalysis projectDependencyAnalysis) {
  if (detectUnusedForOptionalScope) {

src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java

@@ -91,7 +91,7 @@ protected boolean shouldExclude(MavenProject mavenProject) {
  if (excludeTestProject && mavenProject.getArtifactId().contains("test")) {
  shouldExclude = true;
  }
- if (!BaseCycloneDxMojo.isDeployable(mavenProject)) {
+ if (skipNotDeployed && !BaseCycloneDxMojo.isDeployable(mavenProject)) {
  shouldExclude = true;
  }
  return shouldExclude;

src/main/java/org/cyclonedx/maven/CycloneDxMojo.java

@@ -47,6 +47,14 @@
 )
 public class CycloneDxMojo extends BaseCycloneDxMojo {
 
+ /**
+ * Only runs this goal if the module does not skip deploy.
+ *
+ * @since 2.8.0
+ */
+ @Parameter(property = "cyclonedx.skipNotDeployed", defaultValue = "true", required = false)
+ protected boolean skipNotDeployed = true;
+
  /**
  * Specify the Maven project dependency analyzer to use (plexus component role-hint). By default,
  * <a href="https://maven.apache.org/shared/maven-dependency-analyzer/">maven-dependency-analyzer</a>'s one
@@ -97,7 +105,15 @@ protected ProjectDependencyAnalysis doProjectDependencyAnalysis(final MavenProje
  @Override
  protected boolean shouldSkip() {
  // The list of artifacts would be empty
- return super.shouldSkip() || !isDeployable(getProject());
+ return super.shouldSkip() || skipNotDeployed && !isDeployable(getProject());
+ }
+
+ @Override
+ protected String getSkipReason() {
+ if (super.shouldSkip()) {
+ return super.getSkipReason();
+ }
+ return "module skips deploy";
  }
 
  protected String extractComponentsAndDependencies(final Set<String> topLevelComponents, final Map<String, Component> components, final Map<String, Dependency> dependencies) throws MojoExecutionException {