Added support for lifecycle and other args to server

[prabhu]

Both of these query parameters are valid:

lifecycle=pre-build
installDeps=false

Tested with:

curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/server-lifecycle&type=python&lifecycle=pre-build" > bom.json
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/server-lifecycle&type=python&installDeps=false" > bom.json

[potiuk]

Nice: 🙏

[prabhu]

To support license-compliance, we need to move away from using environment variables.

[prabhu]

We definitely have a reproducibility bug for netty, where the SrcFile attributes are not getting collected correctly.

[prabhu]

@cerrussell simply rerunning the workflow is making the snapshot tests pass. I am suspecting that something related to sdkman is making things flaky.

[potiuk]

I can confirm that the latest release works with lifecycle=pre-build and speeds up our SBOM generation a LOT (from 6 minutes for 25 SBOM files down to ~2 minutes when running in parallel). And we don not have the nasty "build probably failed" messages any more :)

Thanks A LOT for that one.

[potiuk]

See apache/airflow#41015

[prabhu]

Thank you so much for your trust and support! Could you kindly blog about your experience, so that more people can learn about our project.

[potiuk]

Thank you so much for your trust and support! Could you kindly blog about your experience, so that more people can learn about our project.

I am working on an interesting security project with supply chain and yeah - I will add cdxgen to it (but this will ceme in ~ September)