Cake.DependencyTrack 0.0.2

Cake.DependencyTrack

DependencyTrack (https://dependencytrack.org/) is an open source software composition analysis platform that allows organizations to identify and reduce the risk of using third-party components in their applications.

DependencyTrack integrates with multiple sources of vulnerability intelligence, such as the National Vulnerability Database (NVD), and provides a comprehensive view of the security posture of the software supply chain. DependencyTrack supports multiple formats for importing and exporting data, such as Software Bill of Materials (SBOM), CycloneDX, SPDX, and OWASP Dependency-Check. DependencyTrack also offers a rich API and a web-based dashboard for managing and visualizing the analysis results.

Cake.DependencyTrack add-in helps to integrate the dependency track platform to your CI/CD pipelines and provides functionalities like Build time bom upload, fail the pipeline when thresholds are not satisfied.

How To Use?

Sample code:

//Installing package
#addin nuget:?package=Cake.DependencyTrack&version=x.x.x&prerelease&loaddependencies=true

using Cake.DependencyTrack.Models;
using Cake.DependencyTrack;

var target = Argument("target", "Default");
var configuration = Argument("configuration", "Release");

Task("Default")
.Does(async (context) => {
    var settings = new UploadBomSettings{
       ProjectId="99f8c557-5896-4adf-903e-966d7b47e86f",
       AbsoluteBomFilePath="<bom file location>",
       ServerSettings=new ServerSettings{
            BaseServerUrl="<dependency track server base url>",
            ApiKey="<api key>"
       }
    };
    await context.UploadBomFile(settings);
});

RunTarget(target);

Sample code with Auto create option:

Task("Default")
.Does(async (context) => {
    var settings = new UploadBomSettings{
       ProjectName="test",
       Version="CI",
       AutoCreate=true,
       AbsoluteBomFilePath="<bom file location>",
       ServerSettings=new ServerSettings{
            BaseServerUrl="<dependency track server base url>",
            ApiKey="<api key>"
       }
    };
    await context.UploadBomFile(settings);
});

Sample code with threshold validation, if the project metrics are greater then are equal to given threshold then the pipeline will fail

Task("Default")
.Does(async (context) => {
    var settings = new UploadBomSettings{
       ProjectName="test",
       Version="CI",
       AutoCreate=true,
       AbsoluteBomFilePath="<bom file location>",
       ServerSettings=new ServerSettings{
            BaseServerUrl="<dependency track server base url>",
            ApiKey="<api key>"
       }
       ShouldValidateMetrics=true,
       MetricsThresholdSettings=new MetricsThresholdSettings{
            CriticalCount=2,
            HighCount=2,
            MediumCount=2,
            LowCount=2
       }
    };
    await context.UploadBomFile(settings);
});

Parameters