Add SBOM generation capability

.github/workflows/ci.yml

@@ -96,7 +96,7 @@ jobs:
 
   android-ci:
     needs: build-plugin
-    timeout-minutes: 90
+    timeout-minutes: 120
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -165,6 +165,16 @@ jobs:
 
       - run: skip doctor
 
+      - name: "Create and export new app"
+        if: runner.os != 'Linux'
+        working-directory: ${{ runner.temp }}
+        run: |
+          skip init --transpiled-app --free --appid some.app.id some-app SomeApp SomeAppModel
+          # verify that the project itself is free
+          skip verify --sbom --free --project some-app
+          # perform an export of the app
+          skip export --sbom --show-tree --project some-app
+
       # disables to speed up CI
       #- name: "Create and export new Skip Lite app project"
       #  if: runner.os != 'Linux'

Sources/SkipBuild/Commands/ExportCommand.swift

@@ -93,6 +93,9 @@ Build and export the Skip modules defined in the Package.swift, with libraries e
     @Option(help: ArgumentHelp("Destination architectures for native libraries", valueName: "arch"))
     var arch: [AndroidArchArgument] = []
 
+    @Flag(help: ArgumentHelp("Generate SPDX SBOM files alongside export artifacts"))
+    var sbom: Bool = false
+
     func performCommand(with out: MessageQueue) async {
         await withLogStream(with: out) {
             try await runExport(with: out)
@@ -318,6 +321,22 @@ Build and export the Skip modules defined in the Package.swift, with libraries e
             try fs.removeFileTree(projectOutputBaseFolder) // only export the zip file; remove the sources
         }
 
+        // Generate SBOM files if requested
+        if self.sbom {
+            let projectURL = URL(fileURLWithPath: self.project).standardized
+            let sbomFiles = try await SBOMGenerator.generateSBOMFiles(
+                generateIOS: self.ios,
+                generateAndroid: self.android,
+                projectPath: projectURL.path,
+                packageName: packageName,
+                packageJSON: packageJSON,
+                outputDirAbsolute: outputFolderAbsolute,
+                command: self,
+                out: out
+            )
+            createdURLs.append(contentsOf: sbomFiles)
+        }
+
         let outputFolderTitle = outputFolder.abbreviatingWithTilde
 
         await out.write(status: .pass, "Skip export \(packageName) to \(outputFolderTitle) (\(startTime.timingSecondsSinceNow))")