The following plugin provides functionality available through Pipeline-compatible steps. Read more about how to integrate steps into your Pipeline in the Steps section of the Pipeline Syntax page.
For a list of other such plugins, see the Pipeline Steps Reference page.
dependencyTrackPublisher
: Publish BOM to Dependency-Trackartifact : String
See Best Practices for additional information.
The value can contain environment variables in the form of ${VARIABLE_NAME}
which are resolved.
synchronous : boolean
Synchronous publishing mode uploads a BOM to Dependency-Track and waits for Dependency-Track to process and return results. The results returned are identical to the auditable findings but exclude findings that have previously been suppressed. Analysis decisions and vulnerability details are included in the response.
This feature provides per-build results that display all finding details as well as interactive charts that display trending information.
Synchronous mode is possible with Dependency-Track v3.3.1 and higher.
The API key provided requires the VIEW_VULNERABILITY permission to use this feature with Dependency-Track v4.4 and newer!
autoCreateProjects : boolean
(optional)
dependencyTrackApiKey : String
(optional)
dependencyTrackFrontendUrl : String
(optional)
Use this if you run backend and frontend on different servers. If omitted, "Dependency-Track Backend URL" will be used instead.
dependencyTrackUrl : String
(optional)
failedNewCritical : int
(optional)
failedNewHigh : int
(optional)
failedNewLow : int
(optional)
failedNewMedium : int
(optional)
failedTotalCritical : int
(optional)
failedTotalHigh : int
(optional)
failedTotalLow : int
(optional)
failedTotalMedium : int
(optional)
overrideGlobals : boolean
(optional)
Can be ignored in pipelines, just set the properties dependencyTrackUrl
, dependencyTrackFrontendUrl
, dependencyTrackApiKey
and autoCreateProjects
as needed.
projectId : String
(optional)
If the list of projects are not displayed (such as an HTTP 403 response), ensure the API key specified in the global configuration has VIEW_PORTFOLIO permission in addition to BOM_UPLOAD and/or SCAN_UPLOAD. Permissions are defined in Dependency-Track.
projectName : String
(optional)
This is an alternative to specifying the unique UUID. It must be used together with a project version.
Ensure the API key specified in the global configuration has PROJECT_CREATION_UPLOAD permission and that you have enabled Auto Create Projects
.
The value can contain environment variables in the form of ${VARIABLE_NAME}
which are resolved.
projectProperties
(optional)
The API key provided requires the PORTFOLIO_MANAGEMENT permission to use this feature!
description : String
(optional)
group : String
(optional)
swidTagId : String
(optional)
tags : Object
(optional)
All tags are automatically lowercased!
projectVersion : String
(optional)
This is an alternative to specifying the unique UUID. It must be used together with a project name.
Ensure the API key specified in the global configuration has PROJECT_CREATION_UPLOAD permission and that you have enabled Auto Create Projects
.
The value can contain environment variables in the form of ${VARIABLE_NAME}
which are resolved.
unstableNewCritical : int
(optional)
unstableNewHigh : int
(optional)
unstableNewLow : int
(optional)
unstableNewMedium : int
(optional)
unstableTotalCritical : int
(optional)
unstableTotalHigh : int
(optional)
unstableTotalLow : int
(optional)
unstableTotalMedium : int
(optional)
Please submit your feedback about this page through this quick form.
Alternatively, if you don't wish to complete the quick form, you can simply indicate if you found this page helpful?
See existing feedback here.