Bitbucket Pipe to upload a CycloneDX SBOM to Dependency-Track
10K+
Uploads a CycloneDX SBOM to Dependency-Track. The project is automatically created when it does not exist.
script:
- pipe: docker://wollomatic/dtrack-uploader-pipe:latest
variables:
DTRACK_URL: $DTRACK_URL
DTRACK_APIKEY: $DTRACK_APIKEY
PROJECT_NAME: "my-project"
PROJECT_VERSION: $BITBUCKET_COMMIT
# SBOM_FILE: sbom.cdx.json
# HTTP_TIMEOUT: 60s
# HTTP_RETRIES: "2"
# HTTP_RETRY_BUDGET: 5m
| Variable | Required | Default | Description |
|---|---|---|---|
SBOM_FILE | No | sbom.cdx.json | CycloneDX SBOM path |
DTRACK_URL | Yes | — | Dependency-Track HTTPS base URL |
DTRACK_APIKEY | Yes | — | Dependency-Track API key; use a secured Bitbucket variable |
PROJECT_NAME | Yes | — | Project name |
PROJECT_VERSION | Yes | — | Project version |
HTTP_TIMEOUT | No | 60s | Timeout per HTTP attempt |
HTTP_RETRIES | No | 2 | Retries only explicit HTTP 429 rate-limit responses |
HTTP_RETRY_BUDGET | No | 5m | Maximum total time for retries; Retry-After is honored fully within this budget |
The API key needs BOM_UPLOAD. Because the pipe uses autoCreate=true, it also needs PROJECT_CREATION_UPLOAD when the project does not already exist.
The pipe streams the SBOM to POST /api/v1/bom using multipart/form-data. Dependency-Track accepts the upload for asynchronous processing and may return a processing token. The pipe reports successful acceptance, not completion of asynchronous analysis.
To avoid duplicate asynchronous ingestion, network failures and HTTP 5xx responses are not retried automatically. Their upload status is unknown and requires an explicit pipeline retry. A 429 response is retried only when the full Retry-After delay fits within HTTP_RETRY_BUDGET; otherwise the pipe fails with a clear rate-limit error.
Apache License 2.0. See LICENSE.
Content type
Image
Digest
sha256:262ef3c33…
Size
6.3 MB
Last updated
about 1 year ago
docker pull wollomatic/dtrack-uploader-pipePulls:
1,637
Last week