Separate policy evaluation into its own task

[nscuro]

Current Behavior

Policy evaluation is currently performed as a byproduct of vulnerability analysis.

dependency-track/src/main/java/org/dependencytrack/tasks/VulnerabilityAnalysisTask.java

Lines 133 to 140 in 7cfc466

	private void performPolicyEvaluation(Project project, List<Component> components) {
	// Evaluate the components against applicable policies via the PolicyEngine.
	final PolicyEngine pe = new PolicyEngine();
	pe.evaluate(components);
	if (project != null) {
	Event.dispatch(new ProjectMetricsUpdateEvent(project.getUuid()));
	}
	}

This is sub-optimal as it prevents policy evaluation from being kicked off independently. It also blocks a single worker thread for longer than necessary (although policy evaluation is typically quite fast).

Proposed Behavior

Policy evaluation should have its own dedicated event and task. When chaining of events is desired, the onSuccess method of Event may be used, e.g.:

Event
    .dispatch(vulnerabilityAnalysisEvent)
    .onSuccess(policyEvaluationEvent);

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.