[409] Removes non-deployed artifacts from SBOM

[ppkarwasz]

This PR detects reactor artifacts that are neither deployed by maven-deploy-plugin nor nexus-staging-maven-plugin. These artifacts will:

• not appear as dependencies in the aggregate BOM,
• not generate BOMs.

This change is required by our /apache/logging-log4j2#1707 goal.

Fixes #409.

[vy]

@ppkarwasz, great job! 💯 I see you check against maven.deploy.skip and skipNexusStagingDeployMojo Maven properties. What if the user provides <skip>true</skip> in the maven-deploy-plugin (or nexus-staging-maven-plugin) configuration? Is this case also covered?

[ppkarwasz]

@vy,

Yes, <configuration><skip>true</skip></configuration> is also supported.

I am no Maven expert, but assuming that PluginExecution#getConfiguration returns the merged configuration from all sources (parent POM, plugin management, the default configuration for all executions), most use cases should be covered.

The support for the <skip>release</skip> and <skip>snapshots</skip> configurations is omitted for simplicity.

[hboutemy]

great job, thank you

[mszalbach]

Is there a possibility to disable this feature? I have a multi module project where it is not important to deploy the child (and this is disabled because of some other issues in the build structure) but I need the SBOM which will then be packaged in a zip file which will be deployed.

[lcappuccio]

agree with @mszalbach , it should be up to the user to decide if this feature is to be used or not.