Generate SBOM then use trivy to check vulnerabilities on branch 1.x

.jenkins/weekly.jenkins

@@ -0,0 +1,60 @@
+/************************************************************************************
+
+  Weekly Build : 
+  Checks for vulnerability
+
+*************************************************************************************/
+pipeline {
+  agent any
+  tools {
+    maven 'apache-maven-latest'
+    jdk 'temurin-jdk11-latest'
+  }
+  options {
+    timeout (time: 30, unit: 'MINUTES')
+    buildDiscarder(logRotator(numToKeepStr: '3'))
+    disableConcurrentBuilds()
+    durabilityHint('PERFORMANCE_OPTIMIZED')
+  }
+  triggers {
+    // every night between Saturday and Sunday
+    cron 'H H * * 6'
+  }
+  environment {
+    PATH = "${env.HOME}/bin:${env.PATH}"
+  }
+  stages {
+    stage('Build') {
+      steps {
+        // install trivy
+        sh ''' curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b ~/bin v0.48.2 '''
+
+        // Build (optional)
+        sh ''' mvn -B clean install javadoc:javadoc -DskipTests ''' 
+
+        // Generate SBOM for maven 
+        sh ''' mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom '''
+
+        // check for vulnerabilities
+        // "find" to search file
+        // xargs to get correct exit code (find always return 0) 
+        sh ''' find . -type f -path '*/target/bom.json' -print0 | xargs -0 -I {} sh -c 'echo "Scanning "{}""; trivy -q --exit-code 1 sbom "{}"' '''  
+
+        // check licenses
+        // TODO add dash-licenses check when cycloneDx will be supported : https://github.com/eclipse/dash-licenses/issues/191     
+      }
+    }
+  }
+  post {
+    unsuccessful {
+      mail to: '[email protected]',
+           subject: "Build ${env.BUILD_TAG} failed!",
+           body: "Check console output at ${env.BUILD_URL} to view the results."
+    }
+    fixed {
+      mail to: '[email protected]',
+           subject: "Build ${env.BUILD_TAG} back to normal.",
+           body: "Check console output at ${env.BUILD_URL} to view the results."
+    }
+  }
+}

pom.xml

@@ -508,6 +508,11 @@ Contributors:
                         </dependency>
                     </dependencies>
                 </plugin>
+                <plugin>
+                    <groupId>org.cyclonedx</groupId>
+                    <artifactId>cyclonedx-maven-plugin</artifactId>
+                    <version>2.7.10</version>
+                </plugin>
             </plugins>
         </pluginManagement>