Add new workflow and update schema version of cyclonedx

.github/workflows/deptrack-test-workflow.yml

@@ -0,0 +1,40 @@
+name: 'Deptrack deploy'
+
+on:
+  push:
+    branches: [ production ]
+
+jobs:
+  generate-and-push-sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Install cdxgen
+        working-directory: frontend
+        run: npm install -g @cyclonedx/[email protected]
+
+      - name: 'Generate SBOM for maven dependencies'
+        working-directory: backend
+        run: mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
+
+      - name: 'Generate SBOM for npm dependencies'
+        working-directory: frontend
+        run: cdxgen -o ../sbom-npm.xml -t npm .
+
+      - name: 'Merge frontend and backend SBOMs'
+        run: |
+          docker run --rm -v $(pwd):/data cyclonedx/cyclonedx-cli merge --input-files data/backend/target/bom.xml data/sbom-npm.xml --output-file data/sbom.xml
+
+      - name: 'Push merged SBOM to dependency track'
+        env:
+          PROJECT_NAME: okr-production
+        run: |
+          curl --verbose -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
+          --header "X-Api-Key: ${{ secrets.SECRET_OWASP_DT_KEY }}" \
+          --header "Content-Type: multipart/form-data" \
+          --form "autoCreate=true" \
+          --form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
+          --form "projectVersion=latest" \
+          --form "[email protected]"

backend/pom.xml

@@ -100,7 +100,7 @@
                 <artifactId>cyclonedx-maven-plugin</artifactId>
                 <version>2.9.1</version>
                 <configuration>
-                    <schemaVersion>1.4</schemaVersion>
+                    <schemaVersion>1.6</schemaVersion>
                 </configuration>
             </plugin>
             <plugin>