chore(ci): add spdx plugin

Signed-off-by: Sam Gammon <[email protected]>

Author: sgammon

guava/pom.xml

@@ -223,4 +223,33 @@
       </plugin>
     </plugins>
   </build>
+  <profiles>
+    <profile>
+      <id>spdx</id>
+      <activation>
+        <jdk>11</jdk>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.spdx</groupId>
+            <artifactId>spdx-maven-plugin</artifactId>
+            <version>0.7.3</version>
+            <executions>
+              <execution>
+                <id>build-spdx</id>
+                <goals>
+                  <goal>createSPDX</goal>
+                </goals>
+              </execution>
+            </executions>
+            <configuration>
+              <useArtifactID>true</useArtifactID>
+              <includeTransitiveDependencies>false</includeTransitiveDependencies>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
 </project>

pom.xml

@@ -274,6 +274,20 @@
           <artifactId>build-helper-maven-plugin</artifactId>
           <version>3.4.0</version>
         </plugin>
+        <plugin>
+          <artifactId>maven-gpg-plugin</artifactId>
+          <version>3.0.1</version>
+        </plugin>
+        <plugin>
+          <groupId>dev.sigstore</groupId>
+          <artifactId>sigstore-maven-plugin</artifactId>
+          <version>0.4.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.spdx</groupId>
+          <artifactId>spdx-maven-plugin</artifactId>
+          <version>0.7.3</version>
+        </plugin>
       </plugins>
     </pluginManagement>
   </build>
@@ -331,7 +345,6 @@
             <plugin>
               <groupId>dev.sigstore</groupId>
               <artifactId>sigstore-maven-plugin</artifactId>
-              <version>0.4.0</version>
               <executions>
                 <execution>
                   <id>sign</id>
@@ -343,7 +356,6 @@
             </plugin>
             <plugin>
               <artifactId>maven-gpg-plugin</artifactId>
-              <version>3.0.1</version>
               <executions>
                 <execution>
                   <id>sign-artifacts</id>