jenkinsci / jenkinsci/dependency-track-plugin

Support active flag

Open
#463 0 comments 0 reactions 1 assignee Claimed by @sephiroth-j View on GitHub
Dominant language
Java
Stars
53
Forks
29
Avg merge
4d 15h
Merged PRs (30d)
6

Description

### What is your feature request about?

The Jenkins Dependency-Track Plugin currently does not provide a way to control the active state of a project/version when publishing a BOM.

I am aware that a similar request was previously raised in #310 (I cant reopen #462) and was closed as not planned. However, I would like to reconsider this functionality from the perspective of the Dependency-Track API capabilities and CI/CD automation.

Dependency-Track itself supports managing the active state through its API. Since the Jenkins plugin acts as an integration layer between Jenkins pipelines and Dependency-Track, it would be very useful if this capability were also exposed by the plugin.

### Describe the solution you'd like

Add an optional boolean parameter, for example:

dependencyTrackPublisher(
projectName: 'my-project',
projectVersion: '1.2.3',
active: false
)

The parameter should be available for both declarative and scripted pipelines.
If the parameter is not specified, the current/default behavior could remain unchanged to preserve backward compatibility.

Why is this useful?

In our CI/CD process, uploading a new SBOM does not necessarily mean that the corresponding project version is currently active.

For example, we may want to:

keep SBOMs for historical builds,
upload SBOMs for release candidates or pre-production builds,
retain multiple project versions in Dependency-Track,
explicitly decide which versions should be considered active.

Currently, this requires additional API calls or external scripting after publishing the BOM.

Since Dependency-Track already provides the API functionality to manage this state, exposing it directly through the Jenkins plugin would make the integration more complete and would avoid requiring users to implement separate API calls in their pipelines.

This would also allow the lifecycle of Dependency-Track projects to be managed consistently as part of the Jenkins pipeline.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.