jenkinsci / jenkinsci/dependency-track-plugin
Support active flag
- Dominant language
- Java
- Stars
- 53
- Forks
- 29
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 6
Description
### What is your feature request about?
The Jenkins Dependency-Track Plugin currently does not provide a way to control the active state of a project/version when publishing a BOM.
I am aware that a similar request was previously raised in #310 (I cant reopen #462) and was closed as not planned. However, I would like to reconsider this functionality from the perspective of the Dependency-Track API capabilities and CI/CD automation.
Dependency-Track itself supports managing the active state through its API. Since the Jenkins plugin acts as an integration layer between Jenkins pipelines and Dependency-Track, it would be very useful if this capability were also exposed by the plugin.
### Describe the solution you'd like
Add an optional boolean parameter, for example:
dependencyTrackPublisher(
projectName: 'my-project',
projectVersion: '1.2.3',
active: false
)
The parameter should be available for both declarative and scripted pipelines.
If the parameter is not specified, the current/default behavior could remain unchanged to preserve backward compatibility.
Why is this useful?
In our CI/CD process, uploading a new SBOM does not necessarily mean that the corresponding project version is currently active.
For example, we may want to:
keep SBOMs for historical builds,
upload SBOMs for release candidates or pre-production builds,
retain multiple project versions in Dependency-Track,
explicitly decide which versions should be considered active.
Currently, this requires additional API calls or external scripting after publishing the BOM.
Since Dependency-Track already provides the API functionality to manage this state, exposing it directly through the Jenkins plugin would make the integration more complete and would avoid requiring users to implement separate API calls in their pipelines.
This would also allow the lifecycle of Dependency-Track projects to be managed consistently as part of the Jenkins pipeline.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.