Implement Support for SBOM Quality Score Tool (sbomqs) about dependency-track-plugin HOT 2 CLOSED

Thanks @msymons. I'm the creator of the tool, if you do decide to integrate this, please do reach out to me if u run into issues or concerns.

from dependency-track-plugin.

This function goes beyond what this plugin is intended for. It is not a generic SBOM plugin and does not call an external executable, for whatever reason.

You can do this yourself in your Jenkins pipeline.

1. call sbomqs and capture the output: def out = sh(script: 'sbomqs score <sbom-file>', returnStdout: true).trim()
2. extract the score from the captured output and store it in a variable: def score = Float.parseFloat(out.split(' ')[0])
3. let the build fail if the score is to low: if (score < 9.0) { error 'sbom quality to low' }
4. use the feature of setting tags to set the sbomqs-tag when uploading the sbom file: dependencyTrackPublisher artifact: '<sbom-file>', ..., projectProperties: [tags: ["sbomqs=${score}"]]

from dependency-track-plugin.