From 472a83ce9a3433daaad15fb735e31edd3fac8c2d Mon Sep 17 00:00:00 2001 From: JanaME Date: Wed, 28 Oct 2026 17:29:57 +0100 Subject: [PATCH] feat(dependency-track): tag new project versions as library The policies of Dependency-Track are assigned by tag, and what we publish as open source is a library to the sites that install it. The upload sends projectTags, by default "library"; project-tags takes another list. Dependency-Track only applies them when the upload creates the version. --- .github/workflows/dependency-track-upload.yml | 8 +++++++- dependency-track/bin/upload.sh | 10 ++++++++-- docs/sbom.md | 6 ++++++ 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependency-track-upload.yml b/.github/workflows/dependency-track-upload.yml index 32495d5..2f9a527 100644 --- a/.github/workflows/dependency-track-upload.yml +++ b/.github/workflows/dependency-track-upload.yml @@ -4,7 +4,7 @@ name: Dependency-Track - upload SBOMs # Sends the CycloneDX SBOMs of the artifact "sbom" (sbom-.cdx.json, e.g. from # wp-plugin-sbom.yml) to Dependency-Track, one project per kind: # "/ ()" in version , under the parent of the latest -# version. +# version, tagged library unless project-tags says otherwise. # # Authenticates with the GitHub OIDC token of the job, exchanged for a session of the # service account - no stored secret. The caller has to grant id-token: write. @@ -26,6 +26,11 @@ on: required: false type: string default: "sbom" + project-tags: + description: "Comma-separated tags of a new project version - the policies of Dependency-Track are assigned by tag. Open source we publish is a library to whoever installs it" + required: false + type: string + default: "library" tools-ref: required: false type: string @@ -46,6 +51,7 @@ jobs: DT_ACCOUNT: ci-github PROJECT: ${{ github.repository }} VERSION: ${{ inputs.version }} + PROJECT_TAGS: ${{ inputs.project-tags }} SBOM_DIR: sbom steps: - name: Check out the upload script diff --git a/dependency-track/bin/upload.sh b/dependency-track/bin/upload.sh index da8b94d..e0f4d69 100644 --- a/dependency-track/bin/upload.sh +++ b/dependency-track/bin/upload.sh @@ -20,6 +20,9 @@ # DT_ACCOUNT name of the service account # DT_AUDIENCE audience of the OIDC token, as the provider expects it # PROJECT, VERSION project name prefix (owner/repository) and version +# PROJECT_TAGS comma-separated tags of a new version, e.g. library - the +# policies of Dependency-Track are assigned by tag. Only +# applied when the upload creates the project version # SBOM_DIR (default: sbom) # # Credentials go to curl in files, never on the command line or into the log. @@ -112,7 +115,7 @@ for sbom in "${SBOMS[@]}"; do kind="${sbom##*/sbom-}" kind="${kind%.cdx.json}" name="$PROJECT ($kind)" - echo "$sbom → $DT_URL: $name $VERSION" + echo "$sbom → $DT_URL: $name $VERSION${PROJECT_TAGS:+, tags $PROJECT_TAGS}" # Parent of the latest version, by name as a query parameter: the names contain # slashes, which many servers refuse encoded in a path. @@ -132,10 +135,13 @@ for sbom in "${SBOMS[@]}"; do echo "::warning::Latest version of $name not readable, uploading without a parent." fi + tags=() + [[ -n "${PROJECT_TAGS:-}" ]] && tags=(--form "projectTags=$PROJECT_TAGS") + if ! answer="$(dt_call POST "$DT_URL/api/v1/bom" --header "@$WORK/headers" \ --form "autoCreate=true" --form "isLatest=true" \ --form "projectName=$name" --form "projectVersion=$VERSION" \ - ${parent[@]+"${parent[@]}"} --form "bom=@$sbom")"; then + ${parent[@]+"${parent[@]}"} ${tags[@]+"${tags[@]}"} --form "bom=@$sbom")"; then failed=1 continue fi diff --git a/docs/sbom.md b/docs/sbom.md index dffe71e..1576f65 100644 --- a/docs/sbom.md +++ b/docs/sbom.md @@ -153,6 +153,12 @@ released one, marked as the latest. A new version is created under the parent of latest one: move the first version of a project under a parent such as "WordPress plugins" once, and the following ones land there too. +Every new version is tagged `library`: the policies of Dependency-Track are assigned by +tag, and what we publish as open source is a library to the sites that install it - its +findings are judged differently from those of a site we run. `project-tags` takes another +comma-separated list. Dependency-Track only applies tags when the upload creates the +version, so a version that existed before keeps the tags it has; tag those by hand. + The job authenticates with workload identity federation: GitHub's OIDC token of the job, with the audience `https://api.hausmeister.palasthotel.de`, is exchanged for a session of the service account `ci-github` via the workload identity provider `github-actions`. No