Generate Software Bill of Materials (SBOM) / DEPENDENCIES File

[mhellmeier]

🚀 Feature Request

Current Problem

There is no overview of the transitive closure of all dependencies used in the project. Thus, security problems or vulnerabilities of dependencies used are hard to check.

Proposed Solution

A SBOM helps to solve this problem. It should be generated and provided in the repository (for example, in a DEPENDENCIES file).
The SBOM generation should be integrated as a pipeline step (GitHub Action) that checks or updates the file on every pull request or commit on the main branch.

Additional Context

The Eclipse Foundation uses a Dash Tool to generate a DEPENDENCIES file that generates an SBOM and checks their licenses.
Also, other existing tools that generate or use SBOMs, like trivy, Microsoft SBOM Tool, or ort need to be checked.