DependencyTrack / DependencyTrack/dependency-track
Decouple the concept of project from project versions
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, multiple versions of the same project are represented as separate, independent records in the `PROJECT` table.
The concept of a project version is treated very loosely: the fact that two `PROJECT` records represent different versions of the same project is merely implied by both sharing the same `NAME` column.
This poses a challenge for features such as portfolio ACL, where it becomes increasingly impractical to explicitly grant access to individual project versions.
### Proposed Behavior
Decouple *project* from *project version*. Enable features such as portfolio ACL to apply to projects, rather than individual project version.
Most of what is currently associated with a project would switch to being associated with a project *version* instead. A rough sketch:
```mermaid
erDiagram
project {
bigint id pk
text name
}
project_version {
bigint id pk
bigint project_id fk
text name
}
component {
bigint id pk
bigint project_version_id fk
text name
text version
text purl
}
team {
bigint id pk
text name
}
project_version |o--o{ component: "contains"
project_version }|--|| project: "is version of"
project }o--o{ team: "is accessible by"
```
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.