Add detect.project.version.create.when.no.components property #1800
Add detect.project.version.create.when.no.components property #1800bd-samratmuk wants to merge 5 commits into
Conversation
bd-samratmuk
requested review from
Copilot,
cpottsbd,
dterrybd,
shantyk and
zahidblackduck
There was a problem hiding this comment.
Pull request overview
Adds a new configuration switch to optionally skip Black Duck project/version creation when a run yields no detected components and no other scan tools are enabled, while preserving current default behavior.
Changes:
- Introduces
detect.project.version.create.when.no.components(defaulttrue) and wires it through configuration to runtime. - Tracks whether detectors produced any components via a new
hasComponentsflag onBdioResult, computed centrally during BDIO generation. - Implements the conditional short-circuit in intelligent-mode online runs and documents the new property in current release notes.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/java/com/blackduck/integration/detect/workflow/bdio/BdioResult.java | Adds hasComponents flag and accessor to represent whether detector output contains components. |
| src/main/java/com/blackduck/integration/detect/lifecycle/run/step/UniversalStepRunner.java | Computes hasComponents from code location root dependencies and passes it into BdioResult. |
| src/main/java/com/blackduck/integration/detect/lifecycle/run/step/IntelligentModeStepRunner.java | Skips project/version creation when configured and no components/other tools are present. |
| src/main/java/com/blackduck/integration/detect/lifecycle/run/operation/OperationRunner.java | Exposes configuration decision to step runners via a new accessor. |
| src/main/java/com/blackduck/integration/detect/configuration/DetectPropertyFromVersion.java | Adds VERSION_12_0_0 for the new property’s introduction version. |
| src/main/java/com/blackduck/integration/detect/configuration/DetectProperties.java | Defines the new boolean property and help text. |
| src/main/java/com/blackduck/integration/detect/configuration/DetectConfigurationFactory.java | Adds typed config accessor for the new property. |
| documentation/src/main/markdown/currentreleasenotes.md | Documents the new property in the 12.0.0 release notes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (!operationRunner.shouldCreateProjectVersionWhenNoComponents()) { | ||
| boolean hasAnythingToUploadOrScan = bdioResult.hasComponents() | ||
| || detectToolFilter.shouldInclude(DetectTool.SIGNATURE_SCAN) | ||
| || detectToolFilter.shouldInclude(DetectTool.BINARY_SCAN) | ||
| || detectToolFilter.shouldInclude(DetectTool.CONTAINER_SCAN) |
There was a problem hiding this comment.
The early-return test (property=false, no components, no scan tools → runAsGroup never called) has been added. The inverse test — verifying project version creation proceeds when components exist — has not been added as a unit test, and here's why.
runOnline() is a long orchestration method. After the project version creation step, it continues into BDIO upload, signature scan, binary scan, container scan, impact analysis, IaC scan, policy check, risk report, BOM link publishing, and correlated scan count upload — each requiring its own mocks. Writing a unit test that gets past the early return without NPE-ing on the subsequent steps would require ~15-20 additional mock interactions, producing a test that is mostly scaffolding and obscures the actual assertion.
This path is already covered end-to-end by the battery test suite, which exercises the full runOnline() flow against real detectors. The unit test would add maintenance burden without meaningful coverage beyond what battery tests already provide.
| public boolean shouldCreateProjectVersionWhenNoComponents() { | ||
| return detectConfiguration.getValue(DetectProperties.DETECT_PROJECT_VERSION_CREATE_WHEN_NO_COMPONENTS); | ||
| } |
There was a problem hiding this comment.
addressed in the latest commit
|
|
||
| * Support for npm has been extended to 11.13.0 and Node.js 24.17.0. No newline at end of file | ||
| * Support for npm has been extended to 11.13.0 and Node.js 24.17.0. | ||
| * Added property `detect.project.version.create.when.no.components` (default: `true`). When set to `false`, Detect will not create a project version on Black Duck if no components are found and no other scan tools are active. No newline at end of file |
There was a problem hiding this comment.
Suggested revision:
Introduced the property detect.project.version.create.when.no.components (default: true). When configured to false, [detect_product_short] will refrain from creating a project version in [bd_product_long] in cases where no components are identified and no other scan tools are active.
There was a problem hiding this comment.
fixed in the latest commit
What
detect.project.version.create.when.no.components(default:true) that when set tofalse, suppresses project version creation on Black Duck when a scan produces no components and no other scan tools are active.How
hasComponentsflag toBdioResult, computed centrally inUniversalStepRunner.generateBdio()by checking root dependencies across all code locations. All detectors benefit, no detector-specific logic. Default flow is unchanged.Default behaviour
true, existing behaviour fully preserved.