Provide a list of packaged files (SBOM, CycloneDX) as an output

In addition to the executable jar, the rule should produce a Bill of Materials that lists everything packaged in the jar.

The Maven plugin beat us to this. I like their solution, so look at what they are doing:
https://spring.io/blog/2024/05/24/sbom-support-in-spring-boot-3-3

Two outputs:

• bundle the SBOM inside the springboot executable jar
• make the SBOM a Bazel output (or a separate rule), such that input into other rules, such as:
  • internally we have a custom docker image packaging rule, which could put the SBOM into the docker image in a well known location
  • a custom validation rule that parses the SBOM looking for verboten stuff. "scan the SBOM and look for some-dev-only.jar and fail my build if it is found" or "scan the SBOM and look for anything GPL and failed my build"

sprintboot(
   ...
   sbom_generate = True, # default True as of 2.4.0
   sbom_format = "cyclonedx", # only supported value as of 2.4.0
)

Implemenation:
I learned at BazelCon rules_license has apparently gotten support from rules_jvm_external to populate the sbom provider. Look into rules_license as the primary means for generating the sbom. Balance the benefits of that against taking a hard dependency on another project.

Start by reading the Spring Boot SBOM support described in the linked Spring blog, then inspect rules_license and its rules_jvm_external SBOM provider support. Compare that approach with the existing springboot rule and decide how the embedded CycloneDX SBOM and separate Bazel output should be exposed. Done means both outputs are usable by downstream packaging and validation rules without an unnecessary dependency decision left unresolved.