DependencyTrack / DependencyTrack/gh-upload-sbom
Setting Project Version on SBOM upload
- Dominant language
- JavaScript
- Stars
- 66
- Forks
- 33
- Avg merge
- 7h 18m
- Merged PRs (30d)
- 3
Description
Hello community,
I was wondering if it's possible to provide a new project version when uploading an SBOM.
I'm not really a JS dev, but when looking into the action code, it looks like the `projectVersion` is only used in tandem with the `projectName` to know which name/version pair to upload the BOM to.
I'm imagining a scenario where I already know the project UUID, and I would like to upload a new BOM and bump the version, so that I can trace back to the exact state of the code in which Dependency Track identified a vulnerability.
Thanks for any info/hints you may have of how to solve this use-case.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the action code where projectVersion is used with projectName during SBOM upload. Trace whether the upload path can address an existing project by UUID and update its version, then confirm what Dependency-Track behavior is available. Done means the requested UUID-based upload and version bump are supported with clear validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100