build: add CycloneDX runtime SBOM

[zefutoff]

Summary

• add CycloneDX runtime SBOM generation for the Android release
• generate an aggregate dependency inventory from resolved Gradle runtime graphs
• exclude test-only dependencies and build tooling from the runtime SBOM
• enrich the generated SBOM with the vendored Grammalecte engine
• explicitly model the dependency from engine-grammalecte to vendored Grammalecte
• validate required runtime components and reject known test-only components
• add make sbom as the common local and CI entry point
• run SBOM generation and validation in the normal CI workflow
• attach the SBOM and its SHA-256 checksum to signed-release workflow artifacts
• document the SBOM scope and maintenance rules

SBOM format

The project now generates a CycloneDX JSON SBOM at:

build/reports/sbom/grammalecte-android.cdx.json

Current format:

CycloneDX 1.6

The generated runtime inventory currently contains 13 components.

Runtime dependency scope

The Gradle-generated portion is based on resolved runtime configurations and
includes the dependencies actually relevant to the Android release.

Current runtime components include:

• application Gradle modules
• QuickJS-KT
• QuickJS-KT Android runtime
• Kotlin standard library
• kotlinx.coroutines
• resolved transitive runtime dependencies

Test-only dependencies such as JUnit, AndroidX Test and org.json test support
are intentionally excluded.

Build tooling, including the CycloneDX Gradle plugin itself, is also outside
the runtime SBOM boundary.

Vendored Grammalecte

Grammalecte is stored directly in the repository and is therefore not visible
to Gradle dependency resolution.

tools/enrich-sbom.mjs adds it explicitly using the authoritative metadata
from:

tools/grammalecte.env

Current vendored component:

Grammalecte 2.3.0
commit 47af2080202e647110e5199ebd5d4b51d2bd51db
GPL-3.0

CycloneDX reference:

pkg:github/algoo/grammalecte@47af2080202e647110e5199ebd5d4b51d2bd51db

The SBOM dependency graph explicitly records:

engine-grammalecte
    -> Grammalecte

The component also records its immutable upstream VCS reference and vendored
status.

Validation

tools/check-sbom.mjs validates the final enriched document.

It checks:

• CycloneDX format
• CycloneDX specification version
• presence of the application modules
• presence of required runtime components
• absence of known test-only dependencies
• exactly one Grammalecte component
• Grammalecte version and commit consistency with tools/grammalecte.env
• dependency relationship between engine-grammalecte and Grammalecte

The common entry point is:

make sbom

Current validation result:

SBOM validation OK.
CycloneDX specification: 1.6
Components: 13
Vendored Grammalecte: 2.3.0

Dependency verification

The CycloneDX Gradle plugin is pinned through the Gradle version catalog.

Its artifacts and transitives are covered by the existing Gradle dependency
verification mechanism:

gradle/verification-metadata.xml

The metadata was regenerated explicitly for the new plugin dependency and
then normal SBOM generation was successfully executed with verification
enabled.

CI integration

The normal CI workflow now runs:

make sbom

This means dependency inventory generation and validation are checked on pull
requests and on main.

Signed release integration

The manual signed-release workflow now:

1. builds and signs the release APK
2. generates and validates the runtime SBOM
3. computes the APK SHA-256 checksum
4. computes the SBOM SHA-256 checksum
5. uploads all four files as the release workflow artifact

The artifact therefore contains:

app-release-signed.apk
app-release-signed.apk.sha256
grammalecte-android.cdx.json
grammalecte-android.cdx.json.sha256

The workflow still does not publish a public GitHub Release automatically.

Documentation

Added:

docs/sbom.md

Updated:

• README.md
• CHANGELOG.md

The documentation distinguishes the machine-readable runtime dependency
inventory from THIRD_PARTY_NOTICES.md and the remaining human-reviewed
third-party license audit.

Validation performed

• make check
• make sbom
• ./tools/run-actionlint.sh
• git diff --check
• Gradle dependency verification
• CycloneDX JSON generation
• vendored Grammalecte enrichment
• SBOM structural and dependency validation

Roadmap

The Phase 5 item:

SBOM / dependency inventory

remains intentionally unchecked in this PR.

It will be marked complete only after this change is merged to main, the
normal CI succeeds there, and the Signed release workflow produces a real
artifact containing the SBOM and its checksum.