docs: document shopware-cli project sbom command

.wordlist.txt

@@ -280,6 +280,7 @@ CustomerRecoveryAware
 CustomerRecoveryStorer
 CustomerStorer
 CustomerTagRule
+CycloneDX
 DAL
 DBAL
 DDL
@@ -889,6 +890,7 @@ Roadmap
 RouteResponse
 RuleConditionService
 RuntimeException
+SBOM
 SBP
 SCSS
 SDK
@@ -1286,6 +1288,7 @@ cartfacade
 cartpricefacade
 catchable
 catched
+cdx
 cetera
 changelog
 changelogs
@@ -1924,6 +1927,7 @@ saleschannelrepositoryfacade
 salutationId
 sandboxed
 sarven
+sbom
 scalability
 scalable
 schemas

guides/development/tooling/index.md

@@ -33,6 +33,7 @@ Use the lowest-level command that fits the task, but prefer helper or deployment
 | Running common Shopware commands during daily development | `shopware-cli project console <command>` or `swx <command>` | Wraps `bin/console` through Shopware CLI and resolves the project context for you.                                                                       |
 | Starting or managing the local development stack          | `shopware-cli project dev`                                  | Provides the interactive development environment for the Docker-based stack, logs, watchers, and common development tasks.                               |
 | Building a project in CI                                  | `shopware-cli project ci`                                   | Produces a reproducible build artifact with dependencies and assets prepared before deployment.                                                          |
+| Generating a project SBOM                                 | `shopware-cli project sbom`                                 | Writes a CycloneDX 1.7 Software Bill of Materials from `composer.lock` without running the full CI build.                                                  |
 | Installing, updating, or maintaining a deployed instance  | Deployment Helper                                           | Automates deploy-time tasks such as install/update detection, migrations, extension management, maintenance mode, cache handling, and one-time commands. |
 | Debugging an exceptional production issue manually        | Raw commands, carefully                                     | Useful for investigation, but repeated deployment or maintenance steps should move into Deployment Helper configuration.                                 |
 

products/tools/cli/command-types.md

@@ -41,6 +41,7 @@
 shopware-cli project create         # Create a new Shopware 6 project
 shopware-cli project dump       # Dumps the Shopware database
 shopware-cli project ci          # Build Shopware in the CI
+shopware-cli project sbom        # Generate a CycloneDX SBOM from composer.lock
 ```
 
 ### Extension commands

products/tools/cli/project-commands/build.md

@@ -24,6 +24,9 @@ shopware-cli project ci <path>
 - Deletes unnecessary files like `node_modules` and many more to save disk space
 - Deletes source code of compiled assets to save disk space
 - Merges snippets of extensions to speed up Administration
+- Writes a CycloneDX 1.7 SBOM (`sbom.cdx.json`) from `composer.lock`
+
+If you only need the SBOM and not a full CI build, use [`shopware-cli project sbom`](sbom.md) instead.
 
 ## Using private Composer repositories
 

products/tools/cli/project-commands/sbom.md

@@ -0,0 +1,58 @@
+---
+nav:
+  title: Generate a Project SBOM
+  position: 6
+
+---
+
+# Generate a Project SBOM
+
+The `shopware-cli project sbom` command generates a Software Bill of Materials (SBOM) for a Shopware project from `composer.lock`. The output is a [CycloneDX](https://cyclonedx.org/) 1.7 JSON document — the same artifact that `shopware-cli project ci` produces, without running the full CI build.
+
+Use it for security reviews, vulnerability scanning, compliance exports, and release artifacts when you only need the SBOM and not a full production build.
+
+## Usage
+
+```bash
+# Write sbom.cdx.json into the current Shopware project
+shopware-cli project sbom
+
+# Explicit project path, format, and output file
+shopware-cli project sbom ./my-shop \
+  --format cyclonedx-json \
+  --output sbom.json
+
+# Include packages-dev from composer.lock
+shopware-cli project sbom --include-dev-dependencies
+```
+
+If you omit the path argument, Shopware CLI resolves the nearest Shopware project (by walking up the directory tree and looking for `composer.json` / `composer.lock`) and falls back to the current working directory.
+
+## What does it do?
+
+- Reads `composer.lock` (and optionally `composer.json` for the root component name and version)
+- Builds a CycloneDX 1.7 JSON SBOM of Composer packages
+- Writes the document to the configured output path (default: `sbom.cdx.json` in the project root)
+- Exits non-zero with a clear error when `composer.lock` is missing or unreadable
+
+By default, packages from `packages-dev` are **excluded**, matching `project ci`. Pass `--include-dev-dependencies` to include them.
+
+## Command options
+
+| Option | Description | Default |
+|---|---|---|
+| `[path]` | Shopware project directory | Nearest project / working directory |
+| `--format` | SBOM format (`cyclonedx-json` only) | `cyclonedx-json` |
+| `--output` / `-o` | Output file path | `sbom.cdx.json` in the project root |
+| `--include-dev-dependencies` | Include `packages-dev` from `composer.lock` | `false` |
+
+## Relation to `project ci`
+
+`shopware-cli project ci` also writes an SBOM as part of the production build. Prefer `project sbom` when you only need the bill of materials (for scanners, audits, or release packaging) and do not want to run asset compilation or other CI steps.
+
+See also [Build a Complete Project](build.md).
+
+## Requirements
+
+- A valid `composer.lock` in the project root (or the given path)
+- Shopware CLI with the `project sbom` command (from the release that introduced it)