Combine results of multiple dependencyTrackPublisher calls in pipeline about dependency-track-plugin HOT 1 CLOSED

I am not entirely convinced that this would be a good feature and therefore tend not to implement this feature request.

Merging results from different projects leads to a number of other problems, mainly caused by duplicate findings. Duplicates lead to new Github issues. Findings can only be distinguished by the UUID of the project. Some calls of the plugin might have been made with the project UUID. To make the project readable on the overview page, the project name and version would have to be displayed, which would require additional searches. The same applies to the link to the DT project in the sidebar.

Another reason why I am not convinced about this feature is the following. The result of the build job gives you a snapshot of what DT found at that point in time. At the same time, you get an ongoing analysis of the project in DT for the future.

If you want the combined result of multiple BOMs in Jenkins, please merge them using the various tools for that.

You wrote that you tried that but had problems with the plugin. I am curious what those were. The plugin is not interested in the content of the BOM.

p.s.
If your frontend and backend are deployed as one application and have the same version and lifecycle, they should also be tracked as one application in DT. However, if they have different lifecycles and can be deployed separately, they should be tracked as separate projects in DT.

from dependency-track-plugin.