Repository navigation
Conversation
Uploading SBOMs from workflow artifacts to Dependency-Track is deprecated and replaced by https://github.com/eclipse-csi/pia. Remove the policy, its upload task, the workflow_run webhook handler and models, the artifact helpers of the REST client, the DEPENDENCY_TRACK_URL/TOKEN settings, the Dependency-Track release of the dev setup and the related documentation. Organizations whose config repo still contains a dependency_track_upload policy file are unaffected: the file fails to parse, the error is logged, and the stored policy is cleaned up on the next policy fetch. Still to do: - Remove the dependencyTrackUrl and dependencyTrackToken values from the otterdog chart in eclipse-csi/helm-charts. - Unsubscribe the GitHub App from workflow_run events: deliveries are no longer handled, but each one is still logged at INFO level. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>
|
Contributor
|
📖 The documentation of this pull request is previewed at https://csi.eclipse.dev/otterdog-website-preview/pr-preview/pr-944/ Built from bdcf4e5 by this run, updated by every new commit (GitHub Pages may take a minute to publish it). The preview is removed when the pull request is closed. |
Contributor
Author
|
With @mbarbero we agreed to discontinue Otterdog SBOM uploads at the end of this month, in favour of github.com/eclipse-csi/pia. Here's a first stab at removing the related code paths. Self-review pending. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uploading SBOMs from workflow artifacts to Dependency-Track is deprecated and replaced by https://github.com/eclipse-csi/pia. Remove the policy, its upload task, the workflow_run webhook handler and models, the artifact helpers of the REST client, the DEPENDENCY_TRACK_URL/TOKEN settings, the Dependency-Track release of the dev setup and the related documentation.
Organizations whose config repo still contains a dependency_track_upload policy file are unaffected: the file fails to parse, the error is logged, and the stored policy is cleaned up on the next policy fetch.
Still to do:
Assisted-by: Claude:claude-opus-5-5