feat: Dependency track tags reporting

README.md

@@ -138,6 +138,7 @@ Options:
       --project-group             Dependency track project group
       --project-name              Dependency track project name. Default use the directory name
       --project-version           Dependency track project version                                [string] [default: ""]
+      --project-tag               Dependency track project tag. Multiple values allowed.                         [array]
       --project-id                Dependency track project id. Either provide the id or the project name and version tog
                                   ether                                                                         [string]
       --parent-project-id         Dependency track parent project id                                            [string]

bin/cdxgen.js

@@ -136,6 +136,9 @@ const args = _yargs
     default: "",
     type: "string",
   })
+  .option("project-tag", {
+    description: "Dependency track project tag. Multiple values allowed.",
+  })
   .option("project-id", {
     description:
       "Dependency track project id. Either provide the id or the project name and version together",

docs/CLI.md

@@ -81,6 +81,7 @@ Options:
       --project-group             Dependency track project group
       --project-name              Dependency track project name. Default use the directory name
       --project-version           Dependency track project version                                [string] [default: ""]
+      --project-tag               Dependency track project tags. Multiple values allowed.                        [array]
       --project-id                Dependency track project id. Either provide the id or the project name and version tog
                                   ether                                                                         [string]
       --parent-project-id         Dependency track parent project id                                            [string]

docs/README.md

@@ -146,6 +146,8 @@ Invoke cdxgen with the below arguments to automatically submit the BOM to your o
       --project-name           Dependency track project name. Default use the di
                                rectory name
       --project-version        Dependency track project version    [default: ""]
+      --project-tag            Dependency track project tag. Multiple values all
+                               owed.                                     [array]
       --project-id             Dependency track project id. Either provide the i
                                d or the project name and version together
       --parent-project-id      Dependency track parent project id

lib/cli/index.js

@@ -8717,6 +8717,20 @@ export async function submitBom(args, bomContents) {
   ) {
     bomPayload.parentUUID = args.parentProjectId || args.parentUUID;
   }
+  // Add project tags if provided
+  // see https://docs.dependencytrack.org/2024/10/01/v4.12.0/
+  // corresponding API usage documentation can be found on the
+  // API docs site of your instance, see
+  // https://docs.dependencytrack.org/integrations/rest-api/
+  // or public instance see https://yoursky.blue/documentation/rest-api
+  if (typeof args.projectTag !== "undefined") {
+    // If args.projectTag is not an array, convert it to an array
+    // Attention, array items should be of form { name: "tagName " }
+    // see https://yoursky.blue/documentation/rest-api#tag/bom/operation/UploadBomBase64Encoded
+    bomPayload.projectTags = (
+      Array.isArray(args.projectTag) ? args.projectTag : [args.projectTag]
+    ).map((tag) => ({ name: tag }));
+  }
   if (DEBUG_MODE) {
     console.log(
       "Submitting BOM to",

lib/cli/index.poku.js

@@ -0,0 +1,124 @@
+import esmock from "esmock";
+import { assert, describe, it } from "poku";
+import sinon from "sinon";
+
+describe("CLI tests", () => {
+  describe("submitBom()", () => {
+    it("should successfully report the SBOM with given project id, name, version and a single tag", async () => {
+      const fakeGotResponse = {
+        json: sinon.stub().resolves({ success: true }),
+      };
+
+      const gotStub = sinon.stub().returns(fakeGotResponse);
+      gotStub.extend = sinon.stub().returns(gotStub);
+
+      const { submitBom } = await esmock("./index.js", {
+        got: { default: gotStub },
+      });
+
+      const serverUrl = "https://dtrack.example.com";
+      const projectId = "f7cb9f02-8041-4991-9101-b01fa07a6522";
+      const projectName = "cdxgen-test-project";
+      const projectVersion = "1.0.0";
+      const projectTag = "tag1";
+      const bomContent = { bom: "test" };
+      const apiKey = "TEST_API_KEY";
+      const skipDtTlsCheck = false;
+
+      const expectedRequestPayload = {
+        autoCreate: "true",
+        bom: "eyJib20iOiJ0ZXN0In0=", // stringified and base64 encoded bomContent
+        project: projectId,
+        projectName,
+        projectVersion,
+        projectTags: [{ name: projectTag }],
+      };
+
+      await submitBom(
+        {
+          serverUrl,
+          projectId,
+          projectName,
+          projectVersion,
+          apiKey,
+          skipDtTlsCheck,
+          projectTag,
+        },
+        bomContent,
+      );
+
+      // Verify got was called exactly once
+      sinon.assert.calledOnce(gotStub);
+
+      // Grab call arguments
+      const [calledUrl, options] = gotStub.firstCall.args;
+
+      assert.equal(calledUrl, `${serverUrl}/api/v1/bom`);
+      assert.equal(options.method, "PUT");
+      assert.equal(options.https.rejectUnauthorized, !skipDtTlsCheck);
+      assert.equal(options.headers["X-Api-Key"], apiKey);
+      assert.match(options.headers["user-agent"], /@CycloneDX\/cdxgen/);
+      assert.deepEqual(options.json, expectedRequestPayload);
+    });
+
+    it("should successfully report the SBOM with given parent project, name, version and multiple tags", async () => {
+      const fakeGotResponse = {
+        json: sinon.stub().resolves({ success: true }),
+      };
+
+      const gotStub = sinon.stub().returns(fakeGotResponse);
+      gotStub.extend = sinon.stub().returns(gotStub);
+
+      const { submitBom } = await esmock("./index.js", {
+        got: { default: gotStub },
+      });
+
+      const serverUrl = "https://dtrack.example.com";
+      const projectName = "cdxgen-test-project";
+      const projectVersion = "1.1.0";
+      const projectTags = ["tag1", "tag2"];
+      const parentProjectId = "5103b8b4-4ca3-46ea-8051-036a3b2ab17e";
+      const bomContent = {
+        bom: "test2",
+      };
+      const apiKey = "TEST_API_KEY";
+      const skipDtTlsCheck = false;
+
+      const expectedRequestPayload = {
+        autoCreate: "true",
+        bom: "eyJib20iOiJ0ZXN0MiJ9", // stringified and base64 encoded bomContent
+        parentUUID: parentProjectId,
+        projectName,
+        projectVersion,
+        projectTags: [{ name: projectTags[0] }, { name: projectTags[1] }],
+      };
+
+      await submitBom(
+        {
+          serverUrl,
+          parentProjectId,
+          projectName,
+          projectVersion,
+          apiKey,
+          skipDtTlsCheck,
+          projectTag: projectTags,
+        },
+        bomContent,
+      );
+
+      // Verify got was called exactly once
+      sinon.assert.calledOnce(gotStub);
+
+      // Grab call arguments
+      const [calledUrl, options] = gotStub.firstCall.args;
+
+      // Assert call arguments against expectations
+      assert.equal(calledUrl, `${serverUrl}/api/v1/bom`);
+      assert.equal(options.method, "PUT");
+      assert.equal(options.https.rejectUnauthorized, !skipDtTlsCheck);
+      assert.equal(options.headers["X-Api-Key"], apiKey);
+      assert.match(options.headers["user-agent"], /@CycloneDX\/cdxgen/);
+      assert.deepEqual(options.json, expectedRequestPayload);
+    });
+  });
+});

lib/server/server.js

@@ -34,6 +34,7 @@ const ALLOWED_PARAMS = [
   "projectId",
   "projectName",
   "projectGroup",
+  "projectTag",
   "projectVersion",
   "parentUUID",
   "serverUrl",

package.json

@@ -163,6 +163,9 @@
     "@npmcli/package-json": "7.0.4",
     "@npmcli/promise-spawn": "9.0.1",
     "@npmcli/query": "5.0.0",
+    "@sinonjs/commons": "3.0.1",
+    "@sinonjs/fake-timers": "13.0.5",
+    "@sinonjs/samsam": "8.0.3",
     "@sec-ant/readable-stream": "0.6.0",
     "@sindresorhus/is": "7.1.1",
     "@types/http-cache-semantics": "4.0.4",
@@ -233,6 +236,7 @@
     "escalade": "3.2.0",
     "escape-html": "1.0.3",
     "escape-string-regexp": "5.0.0",
+    "esmock": "2.7.3",
     "events-universal": "1.0.1",
     "expand-template": "2.0.3",
     "exponential-backoff": "3.1.3",
@@ -367,6 +371,7 @@
     "side-channel-map": "1.0.1",
     "side-channel-weakmap": "1.0.2",
     "signal-exit": "4.1.0",
+    "sinon": "21.0.0",
     "simple-concat": "1.0.1",
     "simple-get": "4.0.1",
     "slice-ansi": "7.1.2",
@@ -466,7 +471,9 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.8",
+    "esmock": "^2.7.3",
     "poku": "3.0.2",
+    "sinon": "21.0.0",
     "typescript": "5.9.3"
   },
   "optionalDependencies": {
@@ -554,6 +561,9 @@
       "@npmcli/package-json": "7.0.4",
       "@npmcli/promise-spawn": "9.0.1",
       "@npmcli/query": "5.0.0",
+      "@sinonjs/commons": "3.0.1",
+      "@sinonjs/fake-timers": "13.0.5",
+      "@sinonjs/samsam": "8.0.3",
       "@sec-ant/readable-stream": "0.6.0",
       "@sindresorhus/is": "7.1.1",
       "@types/http-cache-semantics": "4.0.4",
@@ -624,6 +634,7 @@
       "escalade": "3.2.0",
       "escape-html": "1.0.3",
       "escape-string-regexp": "5.0.0",
+      "esmock": "2.7.3",
       "events-universal": "1.0.1",
       "expand-template": "2.0.3",
       "exponential-backoff": "3.1.3",
@@ -758,6 +769,7 @@
       "side-channel-map": "1.0.1",
       "side-channel-weakmap": "1.0.2",
       "signal-exit": "4.1.0",
+      "sinon": "21.0.0",
       "simple-concat": "1.0.1",
       "simple-get": "4.0.1",
       "slice-ansi": "7.1.2",