Add ability to set parent project (#345) #346

pmckeown · 2023-01-28T00:15:08Z

Added ability to set project parent. Cannot merge until DT 2401 is fixed.
Clarified behaviour of setParent
Tested against a 4.8.0 Snapshot and added handling of null version

Co-authored-by: jason jason.irwin@idoxgroup.com

* Added ability to set project parent. Cannot merge until [DT 2401](DependencyTrack/dependency-track#2401) is fixed. * Clarified behaviour of setParent * Tested against a 4.8.0 Snapshot and added handling of `null` version --------- Co-authored-by: jason <jason.irwin@idoxgroup.com>

sonarcloud · 2023-01-28T00:17:49Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

86.2% Coverage
0.0% Duplication

sonatype-lift · 2023-01-28T00:17:51Z

src/main/java/io/github/pmckeown/dependencytrack/project/ProjectAction.java

+        ProjectInfo info = null;
+        if (updateReq.hasBomLocation()) {
+            logger.info("Project info will be updated");
+            Optional<ProjectInfo> optInfo = bomParser.getProjectInfo(new File(updateReq.getBomLocation()));


PATH_TRAVERSAL_IN: This API (java/io/File.(Ljava/lang/String;)V) reads a file whose location might be specified by user input

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

@sonatype-lift ignoreall

The ignoreall command is active on this PR, all the existing Lift issues are ignored.

sonatype-lift · 2023-01-28T00:17:53Z

src/main/java/io/github/pmckeown/dependencytrack/upload/UploadBomMojo.java

@@ -61,22 +73,55 @@ public UploadBomMojo(UploadBomAction uploadBomAction, MetricsAction metricsActio
    @Override
    public void performAction() throws MojoExecutionException, MojoFailureException {
        try {
+            logger.info("Update Project Parent: %s", updateParent);
+
+            Project parent = null;


💬 2 similar findings have been found in this PR

Var: Non-constant variable missing @var annotation

Suggested change

Project parent = null;

@Var Project parent = null;

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/io/github/pmckeown/dependencytrack/project/ProjectAction.java 62

src/main/java/io/github/pmckeown/dependencytrack/upload/UploadBomMojo.java 96

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-28T00:17:55Z

🛠 Lift Auto-fix

Some of the Lift findings in this PR can be automatically fixed. You can download and apply these changes in your local project directory of your branch to review the suggestions before committing.¹

# Download the patch
curl https://lift.sonatype.com/api/patch/github.com/pmckeown/dependency-track-maven-plugin/346.diff -o lift-autofixes.diff

# Apply the patch with git
git apply lift-autofixes.diff

# Review the changes
git diff

Want it all in a single command? Open a terminal in your project's directory and copy and paste the following command:

curl https://lift.sonatype.com/api/patch/github.com/pmckeown/dependency-track-maven-plugin/346.diff | git apply

Once you're satisfied commit and push your changes in your project.

You can preview the patch by opening the patch URL in the browser. ↩

pmckeown · 2023-01-28T00:46:31Z

@roadSurfer - I'm a bit reluctant to release a new feature into the plugin that operates against a snapshot of the target system. In general the feature looks fine and allows alignment between the project model in Maven and Dependency Track. So keen to add the feature, just not against the main branch code.

Are you OK to wait until 4.8.0 is released before revisiting?

roadSurfer · 2023-01-28T12:02:30Z

Yes of course! Wasn't sure how you wanted to handle it or what your release plans were.

pmckeown · 2023-01-30T04:45:21Z

Yes of course! Wasn't sure how you wanted to handle it or what your release plans were.

OK cool - will wait until 4.8.0 is released then test this out properly.

pmckeown · 2023-05-03T06:08:05Z

README.md

+From Dependency-Track server 4.8.0 onwards, you can set the project parent by setting `updateParent` to `true`. The 
+parent name will be defaulted to that POM's project parent name. If you wish to override that value, or there is 
+no parent set within the `pom.xml`, then explicitly set `parentName` and `parentVersion`.  
+
+Dependency Track doesn't require a project version to be set which means this will fail if there is no version set on 
+the project in Dependency Track that matches the name of the parent of the maven project or the overridden parentName 
+value.
+
+**Note:** If the parent cannot be found on the Dependency-Track server, the BOM upload will not be attempted in order to
+prevent a project being incorrectly created or updated the server.
+
+| Property          | Required | Default Value             | Example Values        |
+|-------------------|----------|---------------------------|-----------------------|
+| bomLocation       | false    | target/bom.xml            | target/custom-bom.xml |
+| updateProjectInfo | false    | false                     | false                 |
+| updateParent      | false    | false                     | true                  |
+| parentName        | false    | ${project.parent.name}    | my-name-override      |
+| parentVersion     | false    | ${project.parent.version} | my-version-override   |


@roadSurfer I've made some behaviour tweaks from your original PR best documented here.

In my view not defaulting the parent version to that of the maven parent pom seemed counter-intuitive. I see where you are coming from in that DT doesn't mandate a version on a project. However if that project was created by the plugin, then the version will be set. If the project wasn't created by this plugin and is missing a version, it can be added in the DT UI and then set as the parentVersion property in the use of this plugin to link it up.

Does that sound reasonable to you and not too far from your original intent?

Seems totally fine to me.

pmckeown · 2023-05-03T06:12:18Z

src/main/java/io/github/pmckeown/dependencytrack/upload/UploadBomMojo.java

            metricsAction.refreshMetrics(project);
        } catch (DependencyTrackException ex) {
            handleFailure("Error occurred during upload", ex);
        }
    }

+    private Project getProjectParent(String parentName, String parentVersion)
+            throws DependencyTrackException {


I've made some tweaks the implementation of setting the parent too.

During testing, the error messages were not being displayed and due to my original implementation of error handling that you followed, the mvn -e was only showing a generic error so nothing useful for the user.

Oops, sorry. I didn't spot this in my testing.

pmckeown · 2023-05-03T06:13:54Z

Tests are failing at the minute on this branch and I'd like to tidy up a bit. So will be delayed a few days on getting this all tidied up.

sonarcloud · 2023-05-06T23:43:48Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

81.9% Coverage
0.0% Duplication

sonatype-lift bot reviewed Jan 28, 2023

View reviewed changes

pmckeown added the depends-on-DT-v4.8.0 label Jan 30, 2023

pmckeown mentioned this pull request Apr 25, 2023

Dependency track shows different results for multi module maven project #363

Closed

pmckeown added 2 commits May 2, 2023 19:33

Merge branch 'main' into feature/338-set-parent-project

e8a417b

updateParent minor refactor of logic and error reporting

6861385

pmckeown commented May 3, 2023

View reviewed changes

pmckeown added 6 commits May 7, 2023 10:51

Rename file and remove test for maven functionality

247290f

Bump dependency versions

da2fddb

Update visibility of test helper methods

d65d271

More unit tests for logic branches

15bffd3

Removed unnecessary stubbings

aad9311

Removed unused imports

a1d589e

pmckeown merged commit 99ab598 into main May 6, 2023
6 checks passed

pmckeown deleted the feature/338-set-parent-project branch May 6, 2023 23:44

pmckeown mentioned this pull request May 7, 2023

Add ability to set project parent on BOM upload #338

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ability to set parent project (#345) #346

Add ability to set parent project (#345) #346

pmckeown commented Jan 28, 2023

sonarcloud bot commented Jan 28, 2023

sonatype-lift bot Jan 28, 2023

pmckeown Jan 28, 2023 •

edited

Loading

sonatype-lift bot Jan 28, 2023

sonatype-lift bot Jan 28, 2023

sonatype-lift bot commented Jan 28, 2023

pmckeown commented Jan 28, 2023

roadSurfer commented Jan 28, 2023

pmckeown commented Jan 30, 2023

pmckeown May 3, 2023

roadSurfer May 3, 2023

pmckeown May 3, 2023

roadSurfer May 3, 2023

pmckeown commented May 3, 2023

sonarcloud bot commented May 6, 2023

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

Add ability to set parent project (#345) #346

Add ability to set parent project (#345) #346

Conversation

pmckeown commented Jan 28, 2023

sonarcloud bot commented Jan 28, 2023

sonatype-lift bot Jan 28, 2023

Choose a reason for hiding this comment

pmckeown Jan 28, 2023 • edited Loading

Choose a reason for hiding this comment

sonatype-lift bot Jan 28, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 28, 2023

Choose a reason for hiding this comment

sonatype-lift bot commented Jan 28, 2023

🛠 Lift Auto-fix

Footnotes

pmckeown commented Jan 28, 2023

roadSurfer commented Jan 28, 2023

pmckeown commented Jan 30, 2023

pmckeown May 3, 2023

Choose a reason for hiding this comment

roadSurfer May 3, 2023

Choose a reason for hiding this comment

pmckeown May 3, 2023

Choose a reason for hiding this comment

roadSurfer May 3, 2023

Choose a reason for hiding this comment

pmckeown commented May 3, 2023

sonarcloud bot commented May 6, 2023

pmckeown Jan 28, 2023 •

edited

Loading