[409] Removes non-deployed artifacts from SBOM

This PR detects reactor artifacts that are neither deployed by
`maven-deploy-plugin` nor `nexus-staging-maven-plugin`. These artifacts
will:
 * not appear as dependencies in the aggregate BOM,
 * not generate BOMs.

Fixes #409.

Signed-off-by: Piotr P. Karwasz <[email protected]>

src/it/makeAggregateBom/pom.xml

@@ -79,6 +79,7 @@
     <modules>
         <module>api</module>
         <module>impls</module>
+        <module>skipped</module>
         <module>util</module>
     </modules>
 

src/it/makeAggregateBom/skipped/pom.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  This file is part of CycloneDX Maven Plugin.
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+
+  SPDX-License-Identifier: Apache-2.0
+  Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.cyclonedx.its</groupId>
+        <artifactId>makeAggregateBom</artifactId>
+        <version>1.0-SNAPSHOT</version>
+    </parent>
+    <artifactId>skipped</artifactId>
+
+    <properties>
+        <maven.deploy.skip>true</maven.deploy.skip>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
+            <version>1.24.0</version>
+        </dependency>
+    </dependencies>
+</project>

src/it/makeAggregateBom/verify.groovy

@@ -21,6 +21,8 @@ assertBomFiles("util/target/bom", false)
 assertBomFiles("impls/target/bom", false)
 assertBomFiles("impls/impl-A/target/bom", false)
 assertBomFiles("impls/impl-B/target/bom", false)
+assert !(new File(basedir, "skipped/target/bom.xml").exists())
+assert !(new File(basedir, "skipped/target/bom.json").exists())
 
 var buildLog = new File(basedir, "build.log").text
 

src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java

@@ -21,12 +21,15 @@
 import org.apache.commons.io.FileUtils;
 import org.apache.maven.artifact.Artifact;
 import org.apache.maven.execution.MavenSession;
+import org.apache.maven.model.Plugin;
+import org.apache.maven.model.PluginExecution;
 import org.apache.maven.plugin.AbstractMojo;
 import org.apache.maven.plugin.MojoExecutionException;
 import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.maven.project.MavenProject;
 import org.apache.maven.project.MavenProjectHelper;
 import org.apache.maven.shared.dependency.analyzer.ProjectDependencyAnalysis;
+import org.codehaus.plexus.util.xml.Xpp3Dom;
 import org.cyclonedx.BomGeneratorFactory;
 import org.cyclonedx.CycloneDxSchema;
 import org.cyclonedx.exception.GeneratorException;
@@ -234,6 +237,12 @@ public abstract class BaseCycloneDxMojo extends AbstractMojo {
     protected static final String MESSAGE_ATTACHING_BOM = "           attaching as %s-%s-cyclonedx.%s";
     protected static final String MESSAGE_VALIDATION_FAILURE = "The BOM does not conform to the CycloneDX BOM standard as defined by the XSD";
 
+    /**
+     * Maven plugins that deploy artifacts.
+     */
+    private static final String MAVEN_DEPLOY_PLUGIN = "org.apache.maven.plugins:maven-deploy-plugin";
+    private static final String NEXUS_STAGING_PLUGIN = "org.sonatype.plugins:nexus-staging-maven-plugin";
+
     /**
      * Returns a reference to the current project.
      *
@@ -262,9 +271,15 @@ protected Component convert(Artifact artifact) {
      */
     protected abstract String extractComponentsAndDependencies(Set<String> topLevelComponents, Map<String, Component> components, Map<String, Dependency> dependencies) throws MojoExecutionException;
 
+    /**
+     * @return {@literal true} if the execution should be skipped.
+     */
+    protected boolean shouldSkip() {
+        return Boolean.parseBoolean(System.getProperty("cyclonedx.skip", Boolean.toString(skip)));
+    }
+
     public void execute() throws MojoExecutionException {
-        final boolean shouldSkip = Boolean.parseBoolean(System.getProperty("cyclonedx.skip", Boolean.toString(skip)));
-        if (shouldSkip) {
+        if (shouldSkip()) {
             getLog().info("Skipping CycloneDX");
             return;
         }
@@ -511,4 +526,43 @@ private Component.Scope mergeScopes(final Component.Scope existing, final Compon
         }
         return existing;
     }
+
+    static boolean isDeployable(final MavenProject project) {
+        return isDeployable(project,
+                        MAVEN_DEPLOY_PLUGIN,
+                        "skip",
+                        "maven.deploy.skip")
+                || isDeployable(project,
+                        NEXUS_STAGING_PLUGIN,
+                        "skipNexusStagingDeployMojo",
+                        "skipNexusStagingDeployMojo");
+    }
+
+    private static boolean isDeployable(final MavenProject project,
+                                        final String pluginKey,
+                                        final String parameter,
+                                        final String propertyName) {
+        final Plugin plugin = project.getPlugin(pluginKey);
+        if (plugin != null) {
+            // Default skip value
+            final String property = System.getProperty(propertyName, project.getProperties().getProperty(propertyName));
+            final boolean defaultSkipValue = property != null ? Boolean.parseBoolean(property) : false;
+            // Find an execution that is not skipped
+            for (final PluginExecution execution : plugin.getExecutions()) {
+                if (execution.getGoals().contains("deploy")) {
+                    final Xpp3Dom executionConf = (Xpp3Dom) execution.getConfiguration();
+                    if (executionConf != null) {
+                        Xpp3Dom target = executionConf.getChild(parameter);
+                        if (target != null && !Boolean.parseBoolean(target.getValue())) {
+                            return true;
+                        }
+                    }
+                    if (!defaultSkipValue) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
 }

src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java

@@ -91,6 +91,9 @@ protected boolean shouldExclude(MavenProject mavenProject) {
         if (excludeTestProject && mavenProject.getArtifactId().contains("test")) {
             shouldExclude = true;
         }
+        if (!BaseCycloneDxMojo.isDeployable(mavenProject)) {
+            shouldExclude = true;
+        }
         return shouldExclude;
     }
 
@@ -146,7 +149,7 @@ protected String extractComponentsAndDependencies(final Set<String> topLevelComp
      */
     private void addMavenProjectsAsParentDependencies(List<MavenProject> reactorProjects, Map<String, Dependency> dependencies) {
         for (final MavenProject project: reactorProjects) {
-            if (project.hasParent()) {
+            if (project.hasParent() && !shouldExclude(project)) {
                 final String parentRef = generatePackageUrl(project.getParent().getArtifact());
                 Dependency parentDependency = dependencies.get(parentRef);
                 if (parentDependency != null) {

src/main/java/org/cyclonedx/maven/CycloneDxMojo.java

@@ -94,6 +94,12 @@ protected ProjectDependencyAnalysis doProjectDependencyAnalysis(final MavenProje
         return null;
     }
 
+    @Override
+    protected boolean shouldSkip() {
+        // The list of artifacts would be empty
+        return super.shouldSkip() || !isDeployable(getProject());
+    }
+
     protected String extractComponentsAndDependencies(final Set<String> topLevelComponents, final Map<String, Component> components, final Map<String, Dependency> dependencies) throws MojoExecutionException {
         getLog().info(MESSAGE_RESOLVING_DEPS);