Addition of creating tags, classifier, swid tag id to Jenkins Plugin for Declarative Pipeline Automation about dependency-track-plugin HOT 5 CLOSED

Hello @aejazuddinam , thanks for your suggestions.

• The creation of tags is already tracked at #12 .
• The classifier is imported by DTrack from the BOM - for Java and Maven you can set it as follows mvn -DprojectType=application org.cyclonedx:cyclonedx-maven-plugin:2.5.2:makeBom.
• Setting the SWID could be done in the same call that is required for setting tags. Do you have an example of such a tag for me and how it looks like in the UI?

from dependency-track-plugin.

Thanks Ronny,
SWID Tag ID can be seen at the bottom , in the Identity tab just next to General Tab of Project Details.

Also do we have any examples for sending all notification emails and sending/capturing a project vulnerability report from DT Plugin ? I want to configure it in my declarative pipeline for automation like after bom is imported to a project, rather than going to UI and check vulnerability, a vulnerability report should be delivered to email address

from dependency-track-plugin.

@aejazuddinam ,

SWID Tag ID can be seen at the bottom , in the Identity tab just next to General Tab of Project Details

Yes, I know where to find it in the UI. I just thought you meant a full SWID tag (a rather long xml).

Also do we have any examples for sending all notification emails and sending/capturing a project vulnerability report from DT Plugin ?

I do not understand what you mean. The plugin does not send emails and it is very unlikely do so in the future. Email and other notifications can be configured in Dependency-Track.

from dependency-track-plugin.

Thanks Ronny,
Yes i was specifially looking for sending email functionality for all the project vulnerabilities which i dont see is present in the plugin yet. Only Email functionality is alert notification for Bom processing, bom upload etc.

As part of end to end pipeline automation i was looking for, after a bom is uploaded to a project it will generate components and its vulnerabilities with a list in UI so a report kind of list of all vulnerabilities of a project to my email that this project has 100 vulnerabilities listed etc, it can be in any format (CSV,HTML etc) . Basically to avoid login to UI and check project dashboard

from dependency-track-plugin.

* The classifier is imported by DTrack from the BOM - for Java and Maven you can set it as follows `mvn -DprojectType=application org.cyclonedx:cyclonedx-maven-plugin:2.5.2:makeBom`.

I noticed that DT has a bug that ignores this value for projects being auto-created during BOM upload. I made a PR to fix this - DependencyTrack/dependency-track/pull/1341

from dependency-track-plugin.