Merge remote-tracking branch 'origin/master' into OZG-6472-upgrade-to-keycloak24

Jenkinsfile

@@ -127,23 +127,27 @@ pipeline {
               }
         }
 
-        stage ('OWASP Dependency-Check Vulnerabilities') {
+        stage ('Deploy SBOM to DependencyTrack') {
             steps {
-                dependencyCheck additionalArguments: '''
-                        -o "./"
-                        -s "./"
-                        -f "ALL"
-                        -d /dependency-check-data
-                        --suppression dependency-check-supressions.xml
-                        --disableKnownExploited
-                        --noupdate
-                        --disableArchive
-                        --prettyPrint''', odcInstallation: 'dependency-check-owasp'
-
-                dependencyCheckPublisher pattern: 'dependency-check-report.xml'
+              script {
+                IMAGE_TAG = generateImageTag()
+                
+                configFileProvider([configFile(fileId: 'maven-settings', variable: 'MAVEN_SETTINGS')]) {
+                    withCredentials([string(credentialsId: 'dependency-track-api-key', variable: 'API_KEY')]) {
+
+                        dir('user-manager-server') {
+
+                            catchError(buildResult: 'UNSTABLE', stageResult: 'FAILURE') {
+                                sh "mvn  --no-transfer-progress -s $MAVEN_SETTINGS io.github.pmckeown:dependency-track-maven-plugin:upload-bom -Ddependency-track.apiKey=$API_KEY -Ddependency-track.projectVersion=${IMAGE_TAG} -Ddependency-track.dependencyTrackBaseUrl=https://dependency-track.ozg-sh.de"
+                            }
+                        }
+                    }
+                }
+              }
             }
         }
 
+
         stage('Sonar Checks') {
             when {
                 branch 'master'

pom.xml

@@ -29,13 +29,13 @@
 	<parent>
 		<groupId>de.ozgcloud.common</groupId>
 		<artifactId>ozgcloud-common-dependencies</artifactId>
-		<version>4.3.1</version>
+		<version>4.3.2</version>
 	</parent>
 
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>de.ozgcloud.user</groupId>
 	<artifactId>user-manager</artifactId>
-	<version>2.7.0-SNAPSHOT</version>
+	<version>2.8.0-SNAPSHOT</version>
 	<name>OZG-Cloud User Manager</name>
 	<packaging>pom</packaging>
 
@@ -55,6 +55,11 @@
 		<maven-failsafe-plugin.version>3.2.5</maven-failsafe-plugin.version>
 		<git-commit-id-maven-plugin.version>7.0.0</git-commit-id-maven-plugin.version>
 		<maven-source.plugin.version>3.3.0</maven-source.plugin.version>
+
+		<!-- TODO move to common-dependencies -->
+		<dependency-track-maven-plugin.version>1.7.0</dependency-track-maven-plugin.version>
+		<cyclonedx-maven-plugin.version>2.7.11</cyclonedx-maven-plugin.version>
+
 	</properties>
 
 	<modules>
@@ -233,7 +238,36 @@
 						</execution>
 					</executions>
 				</plugin>
+
+				<plugin>
+					<groupId>io.github.pmckeown</groupId>
+					<artifactId>dependency-track-maven-plugin</artifactId>
+					<version>${dependency-track-maven-plugin.version}</version>
+					<configuration>
+						<dependencyTrackBaseUrl>https://dependency-track.ozg-sh.de</dependencyTrackBaseUrl>
+						<failOnError>true</failOnError>
+						<createProject>true</createProject>
+					</configuration>
+				</plugin>
+
 			</plugins>
 		</pluginManagement>
+
+		<plugins>
+			<plugin>
+				<groupId>org.cyclonedx</groupId>
+				<artifactId>cyclonedx-maven-plugin</artifactId>
+				<version>${cyclonedx-maven-plugin.version}</version>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>makeAggregateBom</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+
 	</build>
 </project>

user-manager-interface/pom.xml

@@ -30,7 +30,7 @@
 	<parent>
 		<groupId>de.ozgcloud.user</groupId>
 		<artifactId>user-manager</artifactId>
-		<version>2.7.0-SNAPSHOT</version>
+		<version>2.8.0-SNAPSHOT</version>
 	</parent>
 
 	<artifactId>user-manager-interface</artifactId>

user-manager-server/pom.xml

@@ -30,7 +30,7 @@
 	<parent>
 		<groupId>de.ozgcloud.user</groupId>
 		<artifactId>user-manager</artifactId>
-		<version>2.7.0-SNAPSHOT</version>
+		<version>2.8.0-SNAPSHOT</version>
 	</parent>
 
 	<artifactId>user-manager-server</artifactId>