From 8dbc70d74de4b21aa7b2d85cba951917e99425d7 Mon Sep 17 00:00:00 2001 From: Emil Abramov <150020997+emil-wire@users.noreply.github.com> Date: Thu, 28 Mar 2024 20:35:01 +0100 Subject: [PATCH] chore: add Technolinator config for dependencytrack, setting the correct java version (SEC-598) (#2720) Co-authored-by: Mohamad Jaara --- .github/technolinator.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/technolinator.yml diff --git a/.github/technolinator.yml b/.github/technolinator.yml new file mode 100644 index 00000000000..3ccc2c5eccd --- /dev/null +++ b/.github/technolinator.yml @@ -0,0 +1,18 @@ +# whether Technolinator does analysis at all; default: true +enable: true +# whether Technolinator shall comment vulnerability reports to pull-requests +enablePullRequestReport: false +analysis: + # whether cdxgen should scan for projects recursively in 'location' or only 'location' itself; default: true + recursive: true + # include only 'required' scoped dependencies to created BOM + requiredScopeOnly: false + # create sbom with evidence (slows down the process) + evidence: true + # exclude the kalium directory because a) it throws errors that can't be resolved and b) it doesn't matter, as its + # scanned as its own project anyway and it would be a duplicated effort + # excludes: + # - kalium +jdk: + # select JDK version used by cdxgen on JVM based projects + version: 17