Last BOM import results from Dependency-Track unclear

[denniebouman]

Describe the bug
When using multiple projects in Dependency-Track, with:

Metric type: Source up-to-dateness
Source type: Dependency Track
Project event type(s): last BOM import

Then all projects are displayed in the Dependency-Track tab, regardless whether they meet the metric target or not.
The metric may indicate (with the correct metric target) which project has the oldest BOM import, based on the number of days.

The above causes confusion, because other metrics, most of the time, show the number of violations in the metric and only the findings in the detail tab.

Possible adjustment(s)

• Make metrics configurable for:
  • Metric scale: Count and Metric unit: days
  • Metric scale: Count and Metric unit: number of violations
• Keep the implementation as-is and in the detail tab provide the violations with a color with the deviations from the metric target
• Keep implementation as-is and use a toggle to show only violations in the detail tab, or all projects
• ..

[fniessink]

Tasks:

• For all sources that support source up-to-dateness and include measurement entities in the measurement result, color the measurement entities based on whether they meet the (near) target.

Open issues

Dependency-Track has two dates that can be used to evaluate the metric. How to color a DT-project in the measurement entities? Give each date its own color? That is not currently supported by the QT-architecture. Color the row, based on the currently selected date? The user can pick both dates, so this may be unclear in the UI.