DependencyTrack / DependencyTrack/dependency-track

Restrict Analysers Based on Project Tag

Open
#5,986 0 comments 0 reactions 0 assignees View on GitHub
enhancement integration/ossindex
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

This enhancement is intended to be complementary to #5985

OSSIndex is being deprecated by Sonatype in favour of [Guide](https://guide.sonatype.com/). This will limit the number of free queries to 5000 (equivalent to 500 credits).

Once the number of credits for the month is exhausted, no fresh analysis results will be generated. It is possible to pay for credits (5000 for $100 per month) but even this might not be sufficient for a small system with a couple of large npm projects.

### Proposed Behavior

Allow admin user to specify which projects are priority for "100% analysis" for (say) Guide by using a project tag. Other projects will still get updates from the cache, although coverage might not be 100%... but that is where GHSA can be useful for filling in gaps.

Such an approach would be useful for the admin who does not want to tweak the TTL of the analyzer cache. Sometimes it would be useful to do both. It all depends on the nature of the projects, factoring in amount of duplication of components, number of projects, type of projects (eg, no npm projects with 1000 components), etc.

This functionality will also be useful for the case where the admin is simply trying to work out what tier of paid model is required.

See DependencyTrack/frontend/issues/1485 which logs an enhancement for exposing metrics for usage of Guide.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.