Appendix: dependency analysis before the build

Table of Contents

Compare the points in the workflow
Optional instructor demonstration

Use this optional discussion to compare developer-side dependency analysis with the built-image evidence in Track 7. Red Hat Dependency Analytics (RHDA) is an IDE workflow; the workshop’s Showroom terminal does not provide that IDE experience.

Compare the points in the workflow

Stage	Question to investigate	Workshop connection
Editing the application	What dependency risks are visible from the project manifest and resolved dependency graph?	The POM and exact version selected in 2.2 and committed in Track 3.
Building the image	Which components are present in the resulting artifact?	The pipeline’s Syft Task generates and persists the inventory in 4.4. A local Syft installation in Showroom is unnecessary.
Reviewing production	Does the stored inventory describe the promoted digest, and what does the advisory say about its components?	The retrieved TPA SBOM and scoped report in 7.1 and 7.2.

Stage

Question to investigate

Workshop connection

Editing the application

What dependency risks are visible from the project manifest and resolved dependency graph?

The POM and exact version selected in 2.2 and committed in Track 3.

Building the image

Which components are present in the resulting artifact?

The pipeline’s Syft Task generates and persists the inventory in 4.4. A local Syft installation in Showroom is unnecessary.

Reviewing production

Does the stored inventory describe the promoted digest, and what does the advisory say about its components?

The retrieved TPA SBOM and scoped report in 7.1 and 7.2.

Developer analysis can help you decide which source change to investigate. The image inventory provides a later observation of the built artifact. Compare the package identity and exact version across both; do not expect a public analyzer to recognize the workshop’s seeded sample advisory.

Optional instructor demonstration

Prepare a supported IDE and the RHDA extension on your laptop using its current documentation. Confirm the configured analysis service and the information it receives before analyzing a customer project. The workshop TPA UI Route is not automatically an RHDA analysis endpoint.

Open a demonstration POM, run dependency analysis, and explain the result. Then compare its dependency view with the application’s saved CycloneDX inventory. Record any difference in scope, package resolution, or advisory source. Installing or configuring the IDE is outside the required workshop path.