Skip to content

Add missing permission in DT API key docs #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lukpueh wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add missing permission in DT API key docs #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions pia/cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,21 @@
-----------
- sync: Reconcile all project authorizations from a curated file into the
database (create/update/delete).
- DependencyTrack API key needs VIEW_PORTFOLIO permission
- Permissionless GitHub token is optional for higher rate limits

- create-dt-projects: Create the DependencyTrack projects referenced by a curated
file (provisioning only; no database access).
- DependencyTrack API key needs VIEW_PORTFOLIO and PORTFOLIO_MANAGEMENT permission

Usage Example
-------------
PIA_DATABASE_URL=postgresql://user:secret@localhost:5432/pia \
PIA_DEPENDENCY_TRACK_API_KEY=<API key with VIEW_PORTFOLIO permission> \
PIA_GITHUB_TOKEN=<optional token with public read permission for rate limit> \
PIA_DATABASE_URL=postgresql://<user>:<secret>@<host>:<port>/<db> \
PIA_DEPENDENCY_TRACK_API_KEY=<secret> \
PIA_GITHUB_TOKEN=<secret> \
uv run pia sync projects.yaml --dt-url https://sbom.eclipse.org --dry-run

PIA_DEPENDENCY_TRACK_API_KEY=<API key with PORTFOLIO_MANAGEMENT permission> \
PIA_DEPENDENCY_TRACK_API_KEY=<secret> \
uv run pia create-dt-projects projects.yaml --dt-url https://sbom.eclipse.org

"""
Expand Down Expand Up @@ -157,8 +161,8 @@ def create_dt_projects(file: str, dt_url: str | None) -> None:
`pia sync` whenever a file introduces new DependencyTrack targets.
Idempotent: existing projects are left as-is.

Requires --dt-url and PIA_DEPENDENCY_TRACK_API_KEY (with PORTFOLIO_MANAGEMENT
permission to create projects).
Requires --dt-url and PIA_DEPENDENCY_TRACK_API_KEY (with VIEW_PORTFOLIO and
PORTFOLIO_MANAGEMENT permission to create projects).
"""
pf = load_projects_file(file)
validate_projects_file(pf)
Expand Down
14 changes: 7 additions & 7 deletions pia/sync.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,13 +310,13 @@ def ensure_dt_projects(
) -> list[tuple[str, str]]:
"""Create any missing DependencyTrack projects for the file's DT mappings.

For every product of every curated Eclipse Foundation project, ensure the root
and child project exist on DependencyTrack, creating whichever are missing.
This is the provisioning step behind ``pia create-dt-projects``: it touches
only DependencyTrack (no PIA database, no GitHub) and is idempotent — an
existing project is resolved, not recreated. Requires a DT API key with
PORTFOLIO_MANAGEMENT permission. Returns the ``(project, product)`` pairs it
ensured, for reporting.
For every product of every curated Eclipse Foundation project, ensure the
root and child project exist on DependencyTrack, creating whichever are
missing. This is the provisioning step behind ``pia create-dt-projects``:
it touches only DependencyTrack (no PIA database, no GitHub) and is
idempotent — an existing project is resolved, not recreated. Requires a DT
API key with VIEW_PORTFOLIO and PORTFOLIO_MANAGEMENT permission. Returns
the ``(project, product)`` pairs it ensured, for reporting.
"""
root_cache: dict[str, dict[str, Any]] = {}
ensured: list[tuple[str, str]] = []
Expand Down
Loading