From 7978b139b777af3a07dbb38ce8dff140213f7c6c Mon Sep 17 00:00:00 2001
From: Roman Stoffel <roman.stoffel@gamlor.info>
Date: Mon, 20 Jan 2025 22:32:12 +0100
Subject: [PATCH] .

---
 contrib/package.mill                          |  1 +
 .../mill/contrib/sbom/CycloneDXModule.scala   | 20 +++++++++++++----
 .../contrib/sbom/CyclonDXModuleTests.scala    | 22 +++++++++++++++++++
 main/util/src/mill/util/CoursierSupport.scala |  3 +++
 4 files changed, 42 insertions(+), 4 deletions(-)
 create mode 100644 contrib/sbom/test/src/mill/contrib/sbom/CyclonDXModuleTests.scala

diff --git a/contrib/package.mill b/contrib/package.mill
index 9d2b3837bfc..ca7175e9af3 100644
--- a/contrib/package.mill
+++ b/contrib/package.mill
@@ -214,5 +214,6 @@ object `package` extends RootModule {
 
   object sbom extends ContribModule {
     def compileModuleDeps = Seq(build.scalalib)
+    def testModuleDeps: Seq[JavaModule] = super.testModuleDeps ++ Seq(build.scalalib)
   }
 }
diff --git a/contrib/sbom/src/mill/contrib/sbom/CycloneDXModule.scala b/contrib/sbom/src/mill/contrib/sbom/CycloneDXModule.scala
index 86b1a539ca6..dc509830ab7 100644
--- a/contrib/sbom/src/mill/contrib/sbom/CycloneDXModule.scala
+++ b/contrib/sbom/src/mill/contrib/sbom/CycloneDXModule.scala
@@ -1,7 +1,10 @@
 package mill.contrib.sbom
 
+import coursier.core as cs
+import coursier.core.Configuration
 import mill.*
 import mill.javalib.{BoundDep, JavaModule}
+import mill.util.CoursierSupport.ResolvedDependency
 import os.Path
 import upickle.default.{ReadWriter, macroRW}
 
@@ -43,7 +46,18 @@ object CycloneDXModule {
 trait CycloneDXModule extends JavaModule {
   import CycloneDXModule.*
 
-  def sbomDeps: T[Agg[BoundDep]] = Target { transitiveRunIvyDeps() ++ transitiveIvyDeps() }
+  def resolvedRunIvyDepsDetails(): Task[Agg[ResolvedDependency]] = Task.Anon {
+    defaultResolver().resolveDependenciesFiles(
+      Seq(
+        BoundDep(
+          coursierDependency.withConfiguration(cs.Configuration.runtime),
+          force = false
+        )
+      ),
+      artifactTypes = Some(artifactTypes()),
+      resolutionParamsMapOpt = Some(_.withDefaultConfiguration(cs.Configuration.runtime))
+    )
+  }
 
   private def sha256(f: Path): String = {
     val md = MessageDigest.getInstance("SHA-256")
@@ -53,9 +67,7 @@ trait CycloneDXModule extends JavaModule {
   }
 
   def sbom: T[SBOM_JSON] = Target {
-    val deps = sbomDeps()
-
-    val resolvedDeps = defaultResolver().resolveDependenciesFiles(deps)
+    val resolvedDeps = resolvedRunIvyDepsDetails()()
 
     val components = resolvedDeps.map { dependency =>
       val dep = dependency.dependency
diff --git a/contrib/sbom/test/src/mill/contrib/sbom/CyclonDXModuleTests.scala b/contrib/sbom/test/src/mill/contrib/sbom/CyclonDXModuleTests.scala
new file mode 100644
index 00000000000..8e0f0cc2213
--- /dev/null
+++ b/contrib/sbom/test/src/mill/contrib/sbom/CyclonDXModuleTests.scala
@@ -0,0 +1,22 @@
+package mill.contrib.sbom
+
+import mill.Agg
+import mill.javalib._
+import mill.testkit.TestBaseModule
+import utest.{TestSuite, Tests, test}
+object CyclonDXModuleTests extends TestSuite{
+  object TestModule extends TestBaseModule {
+    case object versionFile extends JavaModule with CycloneDXModule{
+      def ivyDeps = Agg(
+        ivy"org.testng:testng:6.11"
+      )
+    }
+  }
+
+
+  override def tests = Tests{
+    test("hello world"){
+      assert(false)
+    }
+  }
+}
diff --git a/main/util/src/mill/util/CoursierSupport.scala b/main/util/src/mill/util/CoursierSupport.scala
index 5661a0344f4..328ff52d19d 100644
--- a/main/util/src/mill/util/CoursierSupport.scala
+++ b/main/util/src/mill/util/CoursierSupport.scala
@@ -460,6 +460,9 @@ object CoursierSupport {
     // TODO: For review: Inclear to me if that even needs to be an option, or if we can always return a 'revalidate once' path??
     def withRevalidateOnce: ResolvedDependency = copy(path = path.withRevalidateOnce)
   }
+  object ResolvedDependency {
+
+  }
 
   /**
    * A Coursier Cache.Logger implementation that updates the ticker with the count and