feat: Dependency track tags reporting #2473

gschafra · 2025-10-13T14:31:31Z

Allow providing (multiple) tags for dependency track reporting

malice00 · 2025-10-13T17:02:02Z

Can you please add some tests for this feature, so we actually know it works correctly? Also, can you please sign off on your commit? See git documentation on how to do this, if you're no familiar.

gschafra · 2025-10-13T17:08:31Z

Can you please add some tests for this feature, so we actually know it works correctly? Also, can you please sign off on your commit? See git documentation on how to do this, if you're no familiar.

Are there already any tests in place concerning the reporting to dependency check using command line parameters (like --project-id)? If yes, where can I find those?

AFAICS for the Dependency-Track SBOM submission/reporting features (e.g. --project-id) there seem no tests at all 😞, so I'm missing the test method (unit, integration?) for this use case (CLI param -> expected result).

gschafra · 2025-10-13T17:44:03Z

O.k.. sorry... find a way using quibble for mocking and call expectations of got() in submitBom(). Test will follow tomorrow.

malice00 · 2025-10-13T18:24:08Z

You are correct, we don't have tests for that yet! All the more reason to add some imho.
Preferably they're unit tests (check the xx.poku.js files), but if it's easier, you can check our repotests.yml-workflow and add your repo (if possible, don't want to force proprietary stuff to become public 😉) with tests to it.

prabhu

Thank you! I didn't know about this useful feature before.

lib/cli/index.js

gschafra · 2025-10-17T14:02:11Z

Will try to implement unit tests next week. Still try to find a way and the code location to test by mocking out the client (using quibble?) doing the requests to dtrack and verify against against call (parameter) expectations (using Sinon.js?). This seems not so easy in the JS world 😞

- Allow providing (multiple) tags for dependency track reporting Signed-off-by: Günter Schafranek <[email protected]>

Signed-off-by: Guenter Schafranek <[email protected]>

Signed-off-by: gschafra <[email protected]>

- Reference (link) to dependency-track release v4.12.0 which introduces the feature - API docu links Signed-off-by: Guenter Schafranek <[email protected]>

- Taking dependency-track project id, name, version and tag into account Signed-off-by: Guenter Schafranek <[email protected]>

Signed-off-by: Guenter Schafranek <[email protected]>

gschafra · 2025-10-22T14:21:53Z

You are correct, we don't have tests for that yet! All the more reason to add some imho. Preferably they're unit tests (check the xx.poku.js files), but if it's easier, you can check our repotests.yml-workflow and add your repo (if possible, don't want to force proprietary stuff to become public 😉) with tests to it.

Question: How do you manage the fixed package version overrides in the package.json? I've to add quibble and sinon for mocking and enhanced assertion to the dev packages. As I've seen, ALL packages including their peer dependencies are listed in the "overrides" section of package.json and putting all of them manually is ... painful (?). Are you using any tooling for this?

Signed-off-by: Guenter Schafranek <[email protected]>

malice00 · 2025-10-22T18:38:30Z

Question: How do you manage the fixed package version overrides in the package.json? I've to add quibble and sinon for mocking and enhanced assertion to the dev packages. As I've seen, ALL packages including their peer dependencies are listed in the "overrides" section of package.json and putting all of them manually is ... painful (?). Are you using any tooling for this?

Yeah, unfortunately that's a manual thing -- currently. I added this a couple of days ago and the idea is to at least consciously think about our dependencies, but some form of listing what is missing for easier adding would be nice... I hope I find some time to do that in the next couple of days.

malice00 · 2025-10-22T21:02:44Z

So, the version locking was not a success... I reverted those changes and I kindly ask you to rebase your PR again. If it's not too complicated, you can remove your overrides as well -- or leave them in if everything works with them there.

Signed-off-by: gschafra <[email protected]>

Signed-off-by: Günter Schafranek <[email protected]>

- since pnpm lock changed to added packages Signed-off-by: Günter Schafranek <[email protected]>

Signed-off-by: Günter Schafranek <[email protected]>

Signed-off-by: gschafra <[email protected]>

…nto dependency-track-tags-support # Conflicts: # lib/cli/index.poku.js

Signed-off-by: Guenter Schafranek <[email protected]>

malice00 · 2025-10-24T07:28:57Z

lib/cli/index.poku.js

+    it("should successfully report the SBOM with given parent project, name, version and multiple single tags", async () => {
+      const serverUrl = "https://dtrack.example.com";
+      const projectName = "cdxgen-test-project";
+      const projectVersion = "1.0.0";
+      const projectTag = "tag1";


You're doing such an awesome job, that I hate to bring this up: isn't this just a copy of the above test except now it has a parent set? I'm asking because the test-description says 'multiple' (although it also says 'single'), so I figured this would test with multiple tags...

Yup, test is not ready yet... I'm massively struggling with test stubs (from ESM modules [got]) , which seems not to reset correctly between tests or/and affecting each other concerning expecations (call count). I've "consultated" various info sources (yes, even GPT and co.) but unfortunately without success. I'll dive deeper into this next week when I have some free time.

Please take your time. It will be super cool to have such advanced tests!

gschafra requested a review from prabhu as a code owner October 13, 2025 14:31

gschafra force-pushed the dependency-track-tags-support branch from 7c34e74 to b49a059 Compare October 13, 2025 17:06

prabhu reviewed Oct 14, 2025

View reviewed changes

lib/cli/index.js Show resolved Hide resolved

gschafra marked this pull request as draft October 21, 2025 21:30

gschafra force-pushed the dependency-track-tags-support branch 2 times, most recently from 1ad7ff2 to fbc9c20 Compare October 22, 2025 06:39

Günter Schafranek and others added 2 commits October 22, 2025 08:46

feat: Dependency track tags reporting

d3afc75

- Allow providing (multiple) tags for dependency track reporting Signed-off-by: Günter Schafranek <[email protected]>

test(cli): Started implementing unit test for SBOM reporting params

89c2627

Signed-off-by: Guenter Schafranek <[email protected]>

gschafra force-pushed the dependency-track-tags-support branch from fbc9c20 to 89c2627 Compare October 22, 2025 06:46

gschafra added 4 commits October 22, 2025 09:00

Merge branch 'master' into dependency-track-tags-support

ee85a6f

Signed-off-by: gschafra <[email protected]>

docs(cli): Docs concerning tag feature on SBOM reporting

068be9a

- Reference (link) to dependency-track release v4.12.0 which introduces the feature - API docu links Signed-off-by: Guenter Schafranek <[email protected]>

test(cli): First SBOM reporting test

c3fc454

- Taking dependency-track project id, name, version and tag into account Signed-off-by: Guenter Schafranek <[email protected]>

build(deps): Package fixed versions and overrides

10c6f7c

Signed-off-by: Guenter Schafranek <[email protected]>

gschafra added 2 commits October 22, 2025 16:41

build(deps): Package overrides

9777208

Signed-off-by: Guenter Schafranek <[email protected]>

test(cli): Added another test case

ef52e56

Signed-off-by: Guenter Schafranek <[email protected]>

Merge branch 'master' into dependency-track-tags-support

a99782e

Signed-off-by: gschafra <[email protected]>

malice00 approved these changes Oct 23, 2025

View reviewed changes

Günter Schafranek added 3 commits October 23, 2025 22:54

style(cli): Biome fix/format

d6e797e

Signed-off-by: Günter Schafranek <[email protected]>

build(deps): Reverted overrides, only keeping direct packages

df3d26b

Signed-off-by: Günter Schafranek <[email protected]>

test(utils): Adapted parsePnpmLock test

09a2613

- since pnpm lock changed to added packages Signed-off-by: Günter Schafranek <[email protected]>

gschafra force-pushed the dependency-track-tags-support branch from 097a00a to 09a2613 Compare October 23, 2025 20:57

style: Biome fix/format

24b69ca

Signed-off-by: Günter Schafranek <[email protected]>

gschafra force-pushed the dependency-track-tags-support branch from 8804aa1 to 24b69ca Compare October 23, 2025 21:10

gschafra added 3 commits October 24, 2025 08:56

Merge branch 'master' into dependency-track-tags-support

e58f46d

Signed-off-by: gschafra <[email protected]>

Merge remote-tracking branch 'origin/dependency-track-tags-support' i…

a4efbe0

…nto dependency-track-tags-support # Conflicts: # lib/cli/index.poku.js

test(cli): Code style

a0661b6

Signed-off-by: Guenter Schafranek <[email protected]>

malice00 reviewed Oct 24, 2025

View reviewed changes

Uh oh!

feat: Dependency track tags reporting #2473

Are you sure you want to change the base?

feat: Dependency track tags reporting #2473

Uh oh!

Conversation

gschafra commented Oct 13, 2025

Uh oh!

malice00 commented Oct 13, 2025

Uh oh!

gschafra commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gschafra commented Oct 13, 2025

Uh oh!

malice00 commented Oct 13, 2025

Uh oh!

prabhu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gschafra commented Oct 17, 2025

Uh oh!

gschafra commented Oct 22, 2025

Uh oh!

malice00 commented Oct 22, 2025

Uh oh!

malice00 commented Oct 22, 2025

Uh oh!

malice00 Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

gschafra Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

prabhu Oct 25, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gschafra commented Oct 13, 2025 •

edited

Loading