inheritedRiskScoreThreshold not working on risk score goal

[ilopezv]

dependency-track-maven-plugin: 1.10.2

Following guide at Get Inherited Risk Score

Parameter inheritedRiskScoreThreshold is ignored.

Running in debug mode with parameters:

mvn io.github.pmckeown:dependency-track-maven-plugin:score \
  -Ddependency-track.dependencyTrackBaseUrl=<url> \
  -Ddependency-track.apiKey=<api-key> \
  -Ddependency-track.failOnError=true \
  -DinheritedRiskScoreThreshold=20 -X

shows that no parameter is exposed for config

[DEBUG] Goal:          io.github.pmckeown:dependency-track-maven-plugin:1.10.2:score (default-cli)
[DEBUG] Style:         Regular
[DEBUG] Configuration: <?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <apiKey>${dependency-track.apiKey}</apiKey>
  <dependencyTrackBaseUrl>${dependency-track.dependencyTrackBaseUrl}</dependencyTrackBaseUrl>
  <failOnError default-value="false">${dependency-track.failOnError}</failOnError>
  <pollingConfig>
    <enabled>false</enabled>
    <attempts>${dependency-track.polling.attempts}</attempts>
    <pause>${dependency-track.polling.pause}</pause>
    <timeUnit>${dependency-track.polling.timeUnit}</timeUnit>
  </pollingConfig>
  <projectName default-value="${project.artifactId}">${dependency-track.projectName}</projectName>
  <projectVersion default-value="${project.version}">${dependency-track.projectVersion}</projectVersion>
  <skip default-value="false">${dependency-track.skip}</skip>
  <verifySsl default-value="true">${dependency-track.verifySsl}</verifySsl>
</configuration>

[WARNING] Inherited Risk Score: 15
[INFO] ========================================================================
[DEBUG] Inherited Risk Score Threshold set to: Not set

[ilopezv]

I can confirm that main problem is the lack of user property for inheritedRiskScoreThreshold.

If you define a custom user property for that configuration element it works as espected.

<plugin>
  <groupId>io.github.pmckeown</groupId>
  <artifactId>dependency-track-maven-plugin</artifactId>
  <configuration>
    <inheritedRiskScoreThreshold>${dependency-track.inherited-risk-score-threshold}</inheritedRiskScoreThreshold>
  </configuration>
</plugin>

I think it whold be nice that this parameter hava a built-in user property in order to use that in CI/CD integrations

[elmuerte]

You are right, that setting is not configured to be available as a property.

dependency-track-maven-plugin/src/main/java/io/github/pmckeown/dependencytrack/score/ScoreMojo.java

Lines 32 to 33 in 5caeb2d

	@Parameter
	private Integer inheritedRiskScoreThreshold;

So only available as part of the plugin configuration in the POM.

[ilopezv]

You are right, that setting is not configured to be available as a property.

dependency-track-maven-plugin/src/main/java/io/github/pmckeown/dependencytrack/score/ScoreMojo.java

Lines 32 to 33 in 5caeb2d

@parameter
private Integer inheritedRiskScoreThreshold;
So only available as part of the plugin configuration in the POM.

The problem in this kind of approach is that make imposible to run this goal in applications already deployed.
If we have a user defined property you can call the maven plugin whith no pom.xml inclusión and configure it with -D params at CI/CD pipes