Repository navigation
Use modern CycloneDX tools metadata - #6785
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 8 |
🟢 Coverage 88.57% diff coverage · -0.08% coverage variation
Metric Results Coverage variation ✅ -0.08% coverage variation (-1.00%) Diff coverage ✅ 88.57% diff coverage (70.00%) Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (018760a) Report Missing Report Missing Report Missing Head commit (13592bb) 42967 (+18) 37324 (-20) 86.87% (-0.08%) Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#6785) 35 31 88.57% Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Represent Dependency-Track as a component in CycloneDX 1.5 and newer exports while retaining legacy tool metadata for older schemas. Add serialization and schema validation coverage. Signed-off-by: Akshat Sparsh <akshatsparsh@gmail.com>
c5dbc65 to
18980b1
Compare
nscuro
left a comment
There was a problem hiding this comment.
Thanks! Minor test rearrangement please, otherwise looks good.
Keep the version-specific JSON and XML coverage alongside the existing project export tests. Signed-off-by: Akshat Sparsh <akshatsparsh@gmail.com>
|
Hi @nscuro, the requested test rearrangement is in place. I also ran the full test suite locally against the current |
Description
CycloneDX 1.5 added a component and service based shape for
metadata.tools, but Dependency-Track exports still use the deprecated tools array.This updates 1.5 and newer exports to identify Dependency-Track as an application component. CycloneDX 1.2 through 1.4 exports keep the legacy array. Versions 1.0 and 1.1 continue to omit tool metadata because those schemas do not define it. The requested spec version is now passed into metadata generation for project, component, VDR, and VEX exports.
I also added JSON and XML coverage for versions 1.2 through 1.6, including schema validation and round-trip parsing.
Addressed Issue
Fixes #3937
Additional Details
This PR changes export behavior only. Dependency-Track already models both legacy and component/service-based tool metadata.
Checks run locally:
BomResourceTestandVexResourceTestmake lint-java AGENT=1make build AGENT=1Checklist
This PR fixes a defect, and I have provided tests to verify that the fix is effectiveThis PR introduces changes to the database model, and I have updated the migration changelog accordinglyThis PR introduces new or alters existing behavior, and I have updated the documentation accordinglyThis PR is a substantial change (per the ADR criteria), and I have added an ADR underdocs/adr/