feat: integrate dependency track #4

	name: Generate and Merge BOMs

	on:
	push:
	branches:
	- master
	- "2.3[1-9]"
	- "2.4[0-9]"
	pull_request:
	branches:
	- master
	- "2.3[1-9]"
	- "2.4[0-9]"
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow}}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	create-boms:
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: dhis-2/

	steps:
	- uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.head.sha }}
	fetch-depth: 0
	- name: Set up JDK 17
	uses: actions/setup-java@v4
	with:
	java-version: 17
	distribution: temurin
	cache: maven

	- name: Install CycloneDX CLI
	run: \|
	curl -s https://api.github.com/repos/CycloneDX/cyclonedx-cli/releases/latest \| grep "browser_download_url.*linux.x64" \| cut -d '"' -f 4 \| wget -i -
	sudo mv cyclonedx-linux-x64 /usr/local/bin/
	sudo chmod +x /usr/local/bin/cyclonedx-linux-x64

	- name: Generate BOMs
	run: mvn cyclonedx:makeBom

	- name: Merge BOMs
	run: cyclonedx-linux-x64 merge --input-files $(find . -name 'dxbom.json') --input-format json --output-file target/merged-bom.json --output-format json

	- name: Upload SBOM to DependencyTrack
	env:
	DEPENDENCY_TRACK_API: "https://dt.security.dhis2.org/api/v1/bom"
	run: \|
	curl -X POST "$DEPENDENCY_TRACK_API" \
	--fail-with-body \
	-H "Content-Type: multipart/form-data" \
	-H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_APIKEY }}" \
	-F "project=56383704-d5a2-4a35-ad6a-081f80f5d6d3" \
	-F "bom=@target/merged-bom.json"

Provide feedback