Add build recipe generation to build.sh and integrate new workflows CLI into sbom.sh

[Lukisorisch]

Changes

build.sh

New code that generates the the build recipe for the workflows section of the SBOM.

Add function addTemurinBuildRecipeToSBOM, which is responsible for generating the workflow/recipe section in the SBOM. In detail, it:

1. Reads makejdk-any-platform.args from workspace/config/ to get the original makejdk-any-platform.sh flags.

2. Reads metadata/buildSource.txt from the target directory to recover the GitHub repository URL and the exact commit hash used by the build.

3. Uses the reproducible build timestamp from BUILD_REPRODUCIBLE_DATE (or BUILD_TIMESTAMP if the first does not exist) for the --build-reproducible-date '<timestamp>' flag. (Only add if not present already)

4. Reads metadata/BUILD_ARGS and if it finds a --use-adoptium-devkit flag, extracts the devkit tag and adds -C --use-adoptium-devkit <tag> to the makejdk-any-platform command.

See below for an example and general recipe output.

sbom.sh

Add wrappers around the TemurinGenSBOM CLI so shell code can author formulation.workflows:

workflows

addSBOMWorkflow <javaHome> <classpath> <jsonFile> <formulaRef> <workflowRef> <workflowUid> <workflowName> <taskTypes>

workflows.steps

addSBOMWorkflowStep <javaHome> <classpath> <jsonFile> <formulaRef> <workflowRef> <stepName> <description>

workflows.steps.commands

addSBOMWorkflowStepCmd <javaHome> <classpath> <jsonFile> <formulaRef> <workflowRef> <stepName> <executed>

Each wrapper calls the respective methods in TemurinGenSBOM.java with the right flags.

Example:

{
      "bom-ref" : "formula_temurin_build_script_21.0.10-beta+5-202512031805",
      "workflows" : [
        {
          "bom-ref" : "workflow_temurin_build_script_21.0.10-beta+5-202512031805",
          "uid" : "workflow_temurin_build_script_21.0.10-beta+5-202512031805",
          "name" : "temurin build script 21.0.10-beta+5-202512031805",
          "taskTypes" : [
            "clone",
            "build"
          ],
          "steps" : [
            {
              "name" : "clone repo",
              "description" : "clone repository",
              "commands" : [
                {
                  "executed" : "git clone https://github.com/adoptium/temurin-build.git"
                }
              ]
            },
            {
              "name" : "cd into repository",
              "description" : "cd into temurin-build and checkout commit",
              "commands" : [
                {
                  "executed" : "cd temurin-build"
                },
                {
                  "executed" : "git checkout f4bcbeb80b2dc0a624721f09a91c925e6df2bc90"
                }
              ]
            },
            {
              "name" : "makejdk",
              "description" : "execute makejdk-any-platform.sh",
              "commands" : [
                {
                  "executed" : "bash ./makejdk-any-platform.sh --build-reproducible-date '2025-12-03 18:05:29' --jdk-boot-dir download --build-variant temurin -C --disable-ccache -C --disable-warnings-as-errors -T jdk-hotspot.tar.gz --create-sbom jdk21u"
                }
              ]
            }
          ]
        }
      ]
    }

[github-actions]

Thank you for creating a pull request!
If you have not done so already, please familiarise yourself with our Contributing Guidelines and FAQ, even if you have contributed to the Adoptium project before. GitHub actions will now run a set of jobs against your PR that will lint and unit test your changes. Keep an eye out for the results from these on the latest commit you submitted. For more information, please see our testing documentation.

[andrew-m-leonard]

We will need to construct these names based on the given builds VERSION etc...
I suggest something like:

local formulaName="formula_temurin_build_script_${fullVer}"

fullVer from https://github.com/adoptium/temurin-build/blob/f4bcbeb80b2dc0a624721f09a91c925e6df2bc90/sbin/build.sh#L1010C9-L1010C16

[andrew-m-leonard]

The clone needs to be for the exact temurin-build "commit" that is used for this build, so that in running this recipe it will exactly reproduce this build.
Use ${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/buildSource.txt from

temurin-build/sbin/build.sh

Line 1128 in f4bcbeb

# Add buildRef as JDK Component Property

[andrew-m-leonard]

Need this builds full exact makejdk-any-platform.sh params...

temurin-build/sbin/build.sh

Line 1145 in f4bcbeb

# Add makejdk_any_platform_args JDK Component Property

[andrew-m-leonard]

I would suggest in trying to test this, is you do a local build on your laptop, save the built JDK1 tar.gz, then try and rebuild it using just the SBOM formulation recipe in a completely fresh woerkspace, then see if it is identical to JDK1 tar.gz ?