fix(dependency-track): verify project directly (#1930)

Signed-off-by: Miguel Martinez <[email protected]>

Author: migmartri

app/controlplane/plugins/core/dependency-track/v1/client/sbom.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -136,20 +136,9 @@ func (d *SBOMUploader) Validate(ctx context.Context) error {
 	}
 
 	// Check if the project or parent project exists
-	var projectFound bool
-	projects, err := listProjects(d.host, d.apiKey)
-	if err != nil {
+	if projectFound, err := projectExists(d.host, d.apiKey, existingProjectID); err != nil {
 		return fmt.Errorf("checking that the project exists: %w", err)
-	}
-
-	for _, p := range projects {
-		if p.ID == existingProjectID {
-			projectFound = true
-			break
-		}
-	}
-
-	if !projectFound {
+	} else if !projectFound {
 		return fmt.Errorf("project with ID %q not found", existingProjectID)
 	}
 
@@ -310,45 +299,30 @@ func uploadSBOMRequest(host *url.URL, apiKey string, values map[string]io.Reader
 	return resp, nil
 }
 
-type listProjectsResponseItem struct {
-	ID   string `json:"uuid"`
-	Name string
-}
-
-type listProjectsResponse []listProjectsResponseItem
-
 // We are listing projects instead of accessing a specific one to enable
 // son in the future listing and selection in the UI
-func listProjects(host *url.URL, apiKey string) (listProjectsResponse, error) {
-	apiEndpoint := host.JoinPath("/api/v1/project")
+func projectExists(host *url.URL, apiKey string, projectID string) (bool, error) {
+	apiEndpoint := host.JoinPath(fmt.Sprintf("/api/v1/project/%s", projectID))
 
 	req, err := http.NewRequest(http.MethodGet, apiEndpoint.String(), nil)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 
 	req.Header.Set("X-Api-Key", apiKey)
 	// Submit the request
 	res, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return nil, err
+		return false, err
 	}
 
 	// Check the response
-	if res.StatusCode != http.StatusOK {
-		err = fmt.Errorf("bad status: %s", res.Status)
-		return nil, err
-	}
-
-	resBody, err := io.ReadAll(res.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	resp := make([]listProjectsResponseItem, 0)
-	if err := json.Unmarshal(resBody, &resp); err != nil {
-		return nil, err
+	switch res.StatusCode {
+	case http.StatusOK:
+		return true, nil
+	case http.StatusNotFound:
+		return false, nil
+	default:
+		return false, fmt.Errorf("bad status: %s", res.Status)
 	}
-
-	return resp, nil
 }

app/controlplane/plugins/core/dependency-track/v1/extension.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -79,7 +79,7 @@ func New(l log.Logger) (sdk.FanOut, error) {
 	base, err := sdk.NewFanOut(
 		&sdk.NewParams{
 			ID:          "dependency-track",
-			Version:     "1.4",
+			Version:     "1.6",
 			Description: description,
 			Logger:      l,
 			InputSchema: &sdk.InputSchema{

devel/integrations.md

@@ -10,7 +10,7 @@ Below you can find the list of currently available integrations. If you can't fi
 
 | ID | Version | Description | Material Requirement |
 | --- | --- | --- | --- |
-| [dependency-track](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/dependency-track/v1/README.md) | 1.4 | Send CycloneDX SBOMs to your Dependency-Track instance | SBOM_CYCLONEDX_JSON |
+| [dependency-track](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/dependency-track/v1/README.md) | 1.6 | Send CycloneDX SBOMs to your Dependency-Track instance | SBOM_CYCLONEDX_JSON |
 | [discord-webhook](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/discord-webhook/v1/README.md) | 1.1 | Send attestations to Discord |  |
 | [guac](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/guac/v1/README.md) | 1.0 | Export Attestation and SBOMs metadata to a blob storage backend so guacsec/guac can consume it | SBOM_CYCLONEDX_JSON, SBOM_SPDX_JSON |
 | [slack-webhook](https://github.com/chainloop-dev/chainloop/blob/main/app/controlplane/plugins/core/slack-webhook/v1/README.md) | 1.0 | Send attestations to Slack |  |