feat: add Generate SBOM action to IntelliJ plugin

[a-oren]

Summary

• Add "Generate SBOM" context menu action that generates a CycloneDX SBOM from supported manifest files and saves to a user-chosen location via native Save File dialog
• Add ApiService.generateSbom() method with telemetry tracking (sbom-generation event)
• Bump trustify-da-java-client to 0.0.17 and trustify-da-api-spec to 2.0.7

Test plan

• Right-click a supported manifest file (pom.xml, package.json, etc.) — "Generate SBOM" appears in context menu
• Clicking the action opens a Save File dialog with default filename bom.json
• SBOM is saved in CycloneDX JSON format to the chosen location
• Success notification is shown after saving
• Error dialog is shown on failure
• Action does not appear for unsupported files
• Unit tests pass (./gradlew test)

Resolves: TC-3994
Depends on: TC-3991

🤖 Generated with Claude Code

[a-oren]

/review

[ruromero]

/review

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

[ruromero]

Thanks Adva, some minor changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[a-oren]

Verification Report for TC-3994 (commit d05bf2a)

Check	Result	Details
Review Feedback	PASS	5 code change requests from ruromero — all addressed in commit d05bf2a
Root-Cause Investigation	N/A	No unresolved sub-tasks to investigate
Scope Containment	WARN	Out-of-scope files: SaAction.java, SaUtils.java (review feedback refactoring), PyprojectCAAnnotatorTest.java, ApiServiceTest.java (tests)
Diff Size	PASS	231 additions, 28 deletions, 8 files — proportionate to task scope
Commit Traceability	WARN	1 of 2 commits references TC-3994; second commit "fix: address PR review feedback for Generate SBOM action" is missing the issue ID
Sensitive Patterns	PASS	No sensitive patterns detected
CI Status	PASS	All 7 checks pass (SonarCloud, build-linux, build-macos, build-windows, main, verify, SonarCloud Code Analysis)
Acceptance Criteria	PASS	8 of 8 criteria met
Test Quality	WARN	PyprojectCAAnnotatorTest: ~11 methods are parameterization candidates; ApiServiceTest: test methods missing doc comments
Verification Commands	N/A	No verification commands specified in task

Overall: WARN

Items requiring attention:

1. Commit Traceability — The fix commit d05bf2a does not reference TC-3994 in the message headline or body. Consider amending or noting in future commits.
2. Scope Containment — 4 files not listed in the task's Files to Modify/Create sections were changed. SaAction.java and SaUtils.java changes are justified (review feedback to extract shared manifest list). ApiServiceTest.java is justified (Test Requirements). PyprojectCAAnnotatorTest.java appears unrelated to this task.
3. Test Quality (advisory) — PyprojectCAAnnotatorTest has multiple test methods with identical structure that could be parameterized. ApiServiceTest test methods lack JavaDoc comments.

Acceptance Criteria Detail

#	Criterion	Result
1	"Generate SBOM" action in Find Action dialog	PASS — registered in plugin.xml with id generateSbom
2	Action in editor and explorer context menus	PASS — added to EditorPopupMenu, NavBarToolBar, ProjectViewPopupMenu
3	Save File dialog with default filename bom.json	PASS — FileSaverDescriptor with "json" extension, default "bom.json"
4	SBOM in CycloneDX JSON format saved to chosen location	PASS — delegates to Api.generateSbom(), writes via Files.writeString()
5	Success notification shown after saving	PASS — NotificationGroupManager info notification
6	Error handled with user-visible message	PASS — Messages.showErrorDialog() in catch block
7	Telemetry event sbom-generation with ecosystem property	PASS — TelemetryService.instance().action("sbom-generation") with ECOSYSTEM property, sent on success and error
8	README.md documents the new action	PASS — Generate SBOM feature documented

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.5.11.