add sbom pipeline

.github/workflows/sbom.yaml

@@ -0,0 +1,30 @@
+name: SBOM
+
+on:
+  push:
+    branches:
+      - sbom
+  workflow_dispatch:
+
+jobs:
+  build-test-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        name: checkout
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: maven
+
+      - name: Build (and test) project with Maven
+        run: mvn -B package --file pom.xml
+
+      - name: Scan current project
+        uses: anchore/scan-action@v3
+        with:
+          path: "."
+          fail-build: false

pom.xml

@@ -431,6 +431,19 @@
                     <quarkus.smallrye-metrics.path>/metrics</quarkus.smallrye-metrics.path>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>generate-bom</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>makeAggregateBom</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 </project>