DependencyTrack / DependencyTrack/dependency-track

Add CI information to project

Open
#1,654 5 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Add information about the CI tools that triggered the dependency track job.

[SonarQube](https://www.sonarqube.org/) does this. It adds a field called "detectedCI" to the project analysis if it was triggered by CI.

Here's an excerpt from a real JSON returned by Sonar project analysis API:

```json
{
"paging": {
"pageIndex": 1,
"pageSize": 10,
"total": 22
},
"analyses": [
{
"key": "AYAJFoPcOLJzMQtheSh4",
"date": "2022-04-08T09:08:00-0300",
"events": [
{
"key": "AYAJFpJQOLJzMQtheWe6",
"category": "VERSION",
"name": "1.8.7"
}
],
"projectVersion": "1.8.7",
"manualNewCodePeriodBaseline": false,
"revision": "10a08ad9bfbf30ecae747f5400cab57f0164d539",
"detectedCI": "Gitlab CI"
}
]
}
```

### Current Behavior:

CI information is not stored in project:

```json
[
{
"name": "projectName",
"version": "1.0.0",
"classifier": "APPLICATION",
"directDependencies": "[{\"name\":\"cxf-rt-frontend-jaxws\",\"purl\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12?type=jar\",\"uuid\":\"013f3514-8558-4ae5-abfc-dcd57de4e45b\",\"version\":\"3.1.12\",\"group\":\"org.apache.cxf\",\"purlCoordinates\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12\",\"objectType\":\"COMPONENT\"}]",
"uuid": "a07b3448-a2a1-4197-8530-0b084440c3e3",
"lastBomImport": 1652908808576,
"lastBomImportFormat": "CycloneDX 1.3",
"lastInheritedRiskScore": 1075.0,
"active": true,
"metrics": {
"critical": 56,
"high": 69,
"medium": 52,
"low": 4,
"unassigned": 2,
"vulnerabilities": 183,
"vulnerableComponents": 23,
"components": 153,
"suppressed": 0,
"findingsTotal": 183,
"findingsAudited": 0,
"findingsUnaudited": 183,
"inheritedRiskScore": 1075.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1653183398506,
"lastOccurrence": 1653417442812
}
}
]
```

### Proposed Behavior:

CI information is added to the project, if the dependency track job was triggered by CI:

```json
[
{
"name": "projectName",
"version": "1.0.0",
"classifier": "APPLICATION",
"directDependencies": "[{\"name\":\"cxf-rt-frontend-jaxws\",\"purl\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12?type=jar\",\"uuid\":\"013f3514-8558-4ae5-abfc-dcd57de4e45b\",\"version\":\"3.1.12\",\"group\":\"org.apache.cxf\",\"purlCoordinates\":\"pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxws@3.1.12\",\"objectType\":\"COMPONENT\"}]",
"uuid": "a07b3448-a2a1-4197-8530-0b084440c3e3",
"lastBomImport": 1652908808576,
"lastBomImportFormat": "CycloneDX 1.3",
"lastInheritedRiskScore": 1075.0,
"active": true,
"metrics": {
"critical": 56,
"high": 69,
"medium": 52,
"low": 4,
"unassigned": 2,
"vulnerabilities": 183,
"vulnerableComponents": 23,
"components": 153,
"suppressed": 0,
"findingsTotal": 183,
"findingsAudited": 0,
"findingsUnaudited": 183,
"inheritedRiskScore": 1075.0,
"policyViolationsFail": 0,
"policyViolationsWarn": 0,
"policyViolationsInfo": 0,
"policyViolationsTotal": 0,
"policyViolationsAudited": 0,
"policyViolationsUnaudited": 0,
"policyViolationsSecurityTotal": 0,
"policyViolationsSecurityAudited": 0,
"policyViolationsSecurityUnaudited": 0,
"policyViolationsLicenseTotal": 0,
"policyViolationsLicenseAudited": 0,
"policyViolationsLicenseUnaudited": 0,
"policyViolationsOperationalTotal": 0,
"policyViolationsOperationalAudited": 0,
"policyViolationsOperationalUnaudited": 0,
"firstOccurrence": 1653183398506,
"lastOccurrence": 1653417442812
},
"detectedCI": "Jenkins"
}
]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.