DependencyTrack / DependencyTrack/dependency-track

Tag Management

Open
#586 13 comments 6 reactions 0 assignees View on GitHub
enhancement gnomes
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
Dependency-Track v3.7.1 allows tags to be added to (or removed from) projects by users who have PORTFOLIO_MANAGEMENT permission. This permission includes the ability to *create* new tags.

* There is no mechanism to limit this ability by project (ie, allow users to change tags on projects 1-10 but not on projects 11-20)
* The only tag-related REST API functionality is the ability to return a list of all projects by tag. There is no ability to query the list of available tags, etc.
* There is no functionality to delete a tag from the system, or to edit existing tags.

### Proposed Behavior:
Some items (such as tag deletion and enforcing lower-case) are discussed in #238).
* Add functionality that would allow listing all tags
* Add functionality to allow editing tags. This would be useful when teams change their names or a customer changes their name, etc.
* Allow for tags to be deleted (cleaned up).
* Only allow lower-case tags (this helps avoid duplication)
* Split the permission to create/edit/delete tags from the permission to add/remove tags from a project. I want to restrict the former more than I want to restrict the latter.
* Extending on this, it should be possible to link these permissions to projects, ie, teams A and B and C can change tags on projects 1-20 but team A can only modify tags on 1-10 and team B can only modify tags on 11-20, and team C can modify tags on any project. See #140, currently in milestone 3.9.
* Enhance UI so that users can pick tags from a list when adding tags to a project.
* Extend functionality to REST so that (say) automated BOM upload from dependency-trak plugin could be enhanced to include tag specification.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.