DependencyTrack / DependencyTrack/dependency-track
Add CI information to project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Add information about the CI tools that triggered the dependency track job.
[SonarQube](https://www.sonarqube.org/) does this. It adds a field called "detectedCI" to the project analysis if it was triggered by CI.
Here's an excerpt from a real JSON returned by Sonar project analysis API:
```json
{
"paging": {
"pageIndex": 1,
"pageSize": 10,
"total": 22
},
"analyses": [
{
"key": "AYAJFoPcOLJzMQtheSh4",
"date": "2022-04-08T09:08:00-0300",
"events": [
{
"key": "AYAJFpJQOLJzMQtheWe6",
"category": "VERSION",
"name": "1.8.7"
}
],
"projectVersion": "1.8.7",
"manualNewCodePeriodBaseline": false,
"revision": "10a08ad9bfbf30ecae747f5400cab57f0164d539",
"detectedCI": "Gitlab CI"
}
]
}
```
### Current Behavior:
CI information is not stored in project:
```json
[
{
"name": "projectName",
"version": "1.0.0",
"classifier": "APPLICATION",
"directDependencies": "[{\"name\":\"cxf-rt-frontend-jaxws\",\"purl\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12?type=jar\",\"uuid\":\"013f3514-8558-4ae5-abfc-dcd57de4e45b\",\"version\":\"3.1.12\",\"group\":\"org.apache.cxf\",\"purlCoordinates\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12\",\"objectType\":\"COMPONENT\"}]",
"uuid": "a07b3448-a2a1-4197-8530-0b084440c3e3",
"lastBomImport": 1652908808576,
"lastBomImportFormat": "CycloneDX 1.3",
"lastInheritedRiskScore": 1075.0,
"active": true,
"metrics": {
"critical": 56,
"high": 69,
"medium": 52,
"low": 4,
"unassigned": 2,
"vulnerabilities": 183,
"vulnerableComponents": 23,
"components": 153,
"suppressed": 0,
"findingsTotal": 183,
"findingsAudited": 0,
"findingsUnaudited": 183,
"inheritedRiskScore": 1075.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1653183398506,
"lastOccurrence": 1653417442812
}
}
]
```
### Proposed Behavior:
CI information is added to the project, if the dependency track job was triggered by CI:
```json
[
{
"name": "projectName",
"version": "1.0.0",
"classifier": "APPLICATION",
"directDependencies": "[{\"name\":\"cxf-rt-frontend-jaxws\",\"purl\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12?type=jar\",\"uuid\":\"013f3514-8558-4ae5-abfc-dcd57de4e45b\",\"version\":\"3.1.12\",\"group\":\"org.apache.cxf\",\"purlCoordinates\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12\",\"objectType\":\"COMPONENT\"}]",
"uuid": "a07b3448-a2a1-4197-8530-0b084440c3e3",
"lastBomImport": 1652908808576,
"lastBomImportFormat": "CycloneDX 1.3",
"lastInheritedRiskScore": 1075.0,
"active": true,
"metrics": {
"critical": 56,
"high": 69,
"medium": 52,
"low": 4,
"unassigned": 2,
"vulnerabilities": 183,
"vulnerableComponents": 23,
"components": 153,
"suppressed": 0,
"findingsTotal": 183,
"findingsAudited": 0,
"findingsUnaudited": 183,
"inheritedRiskScore": 1075.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1653183398506,
"lastOccurrence": 1653417442812
},
"detectedCI": "Jenkins"
}
]
```
Contributor guide
Assessment
This issue has not been assessed yet.