Creating or updating a component should trigger a policy evaluation but does not

[fupgang]

Current Behavior

The implementation of ComponentResource shows that a policy evaluation should be triggered when creating or updating a component. In createComponent and updateComponent it's implemented like this:

https://github.com/DependencyTrack/dependency-track/blob/3c265ed6e8880fde6c51302f8c54a04273276269/src/main/java/org/dependencytrack/resources/v1/ComponentResource.java#L368-L374

This does actually not happen. The project field is not set in the PolicyEvaluationEvent, therefore the PolicyEvaluationTask does nothing.

https://github.com/DependencyTrack/dependency-track/blob/3c265ed6e8880fde6c51302f8c54a04273276269/src/main/java/org/dependencytrack/tasks/PolicyEvaluationTask.java#L50-L52

Steps to Reproduce

1. Create or update a component
2. There are no logs by the PolicyEngine since it's not triggered

Expected Behavior

Creating or updating a component should trigger the policy evaluation for this single component. The simplest fix is to set the missing project:

.onSuccess(new PolicyEvaluationEvent(component).project(component.getProject()))

I provide an PR for this.

Dependency-Track Version

4.12.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Google Chrome

Checklist

• [x] I have read and understand the contributing guidelines
• [x] I have checked the existing issues for whether this defect was already reported