How To Generate and Audit SBOM In a CI/CD Pipeline

<!-- snip -->
<plugins>
  <plugin>
     <groupId>org.cyclonedx</groupId>
     <artifactId>cyclonedx-maven-plugin</artifactId>
     <version>2.6.2</version>
     <executions>
        <execution>
           <phase>package</phase>
           <goals>
              <goal>makeAggregateBom</goal>
           </goals>
        </execution>
     </executions>
     <configuration>
         <outputFormat>Json</outputFormat>
     </configuration>
  </plugin>
</plugins>
<!-- snip -->

target
|--- bom.json
|--- bom.xml
|--- classes
|    |--- hello
|         |--- HelloWorld.class
|-------- generated-sources
|         |--- annotations
|--- gs-maven-0.1.0.jar
|--- maven-archiver
|    |--- pom.properties 
|--- maven-status
     |--- maven-compiler-plugin
          |--- compile
               |--- default-compile
                    |--- createdFiles.lst
                    |--- inputFiles.lst

<!-- snip -->
<plugins>
  <plugin>
     <dependency>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>7.1.0</version>
        <configuration>
          <format>JSON</format>
          <cveStartYear>2010</cveStartYear>
        </configuration>
        <type>maven-plugin</type>
        <executions>
           <execution>
              <goals>
                 <goal>check</goal>
              </goals>
           </execution>
        </executions>
     </dependency>
  </plugin>
</plugins>
<!-- snip -->

target
|--- dependency-check.json
|--- classes
|    |--- hello
|         |--- HelloWorld.class
|-------- generated-sources
|         |--- annotations
|--- gs-maven-0.1.0.jar
|--- maven-archiver
|    |--- pom.properties 
|--- maven-status
     |--- maven-compiler-plugin
          |--- compile
               |--- default-compile
                    |--- createdFiles.lst
                    |--- inputFiles.lst

pipeline {
  agent {
     docker {
        image 'maven:3-alpine'
        args '-v /root/.m2:/root/.m2'
     }
  }
  stages {
     stage("SCM Checkout") {
        steps {
           // clone the repository
           git 'https://github.com/CSPF-Founder/JavaVulnerableLab.git'
        }
     }
     stage("Build and Initiate SCA & SBOM Scans") {
        steps {
           // Build the application and run Dependency-Check-Maven & CodeDX SBOM plugins
           sh "mvn -B -DskipTests clean verify"
           // Import the findings to Kondukto
           sh "/usr/local/bin/kdt --config=/etc/kondukto.yaml sbom import -p JavaVulnerableLab -f target/bom.json -b main"
        }
     }
     stage("Publish") {
        steps {
           // publish the app to the prod
           sh "echo 'Publish'"
        }
     }
  } // end of stages
}