DependencyTrack / DependencyTrack/gh-upload-sbom

Setting Project Version on SBOM upload

Open
#46 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
66
Forks
33
Avg merge
7h 18m
Merged PRs (30d)
3

Description

Hello community,

I was wondering if it's possible to provide a new project version when uploading an SBOM.

I'm not really a JS dev, but when looking into the action code, it looks like the `projectVersion` is only used in tandem with the `projectName` to know which name/version pair to upload the BOM to.

I'm imagining a scenario where I already know the project UUID, and I would like to upload a new BOM and bump the version, so that I can trace back to the exact state of the code in which Dependency Track identified a vulnerability.

Thanks for any info/hints you may have of how to solve this use-case.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the action code where projectVersion is used with projectName during SBOM upload. Trace whether the upload path can address an existing project by UUID and update its version, then confirm what Dependency-Track behavior is available. Done means the requested UUID-based upload and version bump are supported with clear validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.