Skip to content

feat(dependency-track): support global annotations in project name - #285

Merged
migmartri merged 3 commits into
chainloop-dev:mainfrom
migmartri:enable-dep-track
Jul 31, 2023
Merged

feat(dependency-track): support global annotations in project name#285
migmartri merged 3 commits into
chainloop-dev:mainfrom
migmartri:enable-dep-track

Conversation

@migmartri

Copy link
Copy Markdown
Member

Allows leveraging global annotations in the dependency-track project name.

For example, let's assume we have the following contract with both material (called component) and global annotations (branch)

cat /tmp/schema-old.json                        
{
        "schemaVersion":  "v1",
        "annotations":  [
                {
                        "name":  "branch",
                        "value": "stable"
                }
        ],
        "materials":  [
                {
                        "type":  "SBOM_CYCLONEDX_JSON",
                        "name":  "controlplane-sbom",
                        "annotations":  [
                                {
                                        "name":  "component",
                                        "value":  "controlplane"
                                }
                        ]
                },
                {
                        "type":  "SBOM_CYCLONEDX_JSON",
                        "name":  "cas-sbom",
                        "annotations":  [
                                {
                                        "name":  "component",
                                        "value":  "cas"
                                }
                        ]
                }
        ]
}

You can now attach the dependency-track instance to leverage both types of annotations

$ chainloop integration attached add .... 
--opt projectName="{{.Material.Annotations.component}}-{{ .Attestation.Annotations.branch }}"  

This will push the SBOMs to different projects based on those annotations.

image

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
@migmartri
migmartri requested a review from danlishka July 31, 2023 11:43
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

@danlishka danlishka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@migmartri
migmartri merged commit b2a5117 into chainloop-dev:main Jul 31, 2023
@migmartri
migmartri deleted the enable-dep-track branch July 31, 2023 12:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants