feat: use score_sbom for license handling

.github/workflows/license_check.yml

@@ -33,7 +33,7 @@ jobs:
     # fork PRs through pull_request_target for approval
     if: >-
       (github.event_name == 'merge_group') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@d2083d5dac0e309643d9f495e61342dfbaf07ed5 # v0.0.3-23-gd2083d5
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
       bazel-target: "run --lockfile_mode=error //:license-check"

BUILD

@@ -13,8 +13,8 @@
 
 load("@score_docs_as_code//:docs.bzl", "docs")
 load("@score_format_checker//:macros.bzl", "use_format_targets")
+load("@score_sbom//:defs.bzl", "sbom")
 load("@score_tooling//:defs.bzl", "cli_helper", "copyright_checker", "dash_license_checker", "setup_starpls")
-load("//:project_config.bzl", "PROJECT_CONFIG")
 
 # Creates all documentation targets:
 # - `:docs` for building documentation at build-time
@@ -60,34 +60,45 @@ copyright_checker(
     visibility = ["//visibility:public"],
 )
 
-# Needed for Dash tool to check python dependency licenses.
-# This is a workaround to filter out local packages from the Cargo.lock file.
-# The tool is intended for third-party content.
-genrule(
-    name = "filtered_cargo_lock",
-    srcs = ["Cargo.lock"],
-    outs = ["Cargo.lock.filtered"],
-    cmd = """
-    awk '
-    BEGIN { skip = 0; data = "" }
-    /^\\[\\[package\\]\\]/ {
-        if (data != "" && !skip) print data;
-        skip = 1;
-        data = $$0;
-        next;
-    }
-    data != "" { data = data "\\n" $$0 }
-    # any package that has a "source = " line will not be skipped.
-    /^source = / { skip = 0 }
-    END { if (data != "" && !skip) print data }
-    ' $(location Cargo.lock) > $@
-    """,
+dash_license_checker(
+    src = "//:Cargo.lock",
+    file_type = "cargo",
+    filter_keywords = ["github.com/eclipse-score/"],
+    visibility = ["//visibility:public"],
 )
 
-dash_license_checker(
-    src = ":filtered_cargo_lock",
-    file_type = "",  # let it auto-detect based on project_config
-    project_config = PROJECT_CONFIG,
+# Generates the product SBOM (SPDX 2.3 + CycloneDX 1.6) for the KVS library.
+# - Rust crate licenses/suppliers come from the crates.io API via
+#   auto_crates_cache (network access required at build time).
+# - Build-time/test tooling is covered separately by //:sbom_docs_tests.
+sbom(
+    name = "sbom_product",
+    component_name = "score_persistency",
+    module_lockfiles = [":MODULE.bazel.lock"],
+    targets = [
+        "//score/kvs:kvs_cpp",
+        "//score/kvs/rust_kvs:rust_kvs",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+# Qualification inventory for Python-based build and test tools. This is kept
+# separate from the product SBOM because build-time dependencies are not
+# product/runtime dependencies.
+sbom(
+    name = "sbom_docs_tests",
+    testonly = True,
+    component_name = "score_persistency",
+    module_lockfiles = [":MODULE.bazel.lock"],
+    python_lockfiles = [
+        "//score/kvs/tests/test_cases:requirements.txt.lock",
+        "@score_docs_as_code//src:requirements_lock",
+    ],
+    targets = [
+        "//:docs",
+        "//:unit_tests",
+        "//:cit_tests",
+    ],
     visibility = ["//visibility:public"],
 )