REQ 007

REQ-007: SBOM pipelines fail closed without DEPENDENCY_TRACK_URL

Requirement

Native and containerized SBOM pipeline scripts (Run-Pipeline.ps1, Run-WindowsSbom.ps1, Run-LinuxSbom.ps1) shall fail closed (no default) if DEPENDENCY_TRACK_URL is required for the requested reporting mode but not supplied.

Rationale

Prevents a fork without a configured Dependency-Track server from silently attempting to reach someone else's private instance.

Fit Criterion

Running in full reporting mode with DEPENDENCY_TRACK_URL unset produces a clear error and no network call to any default host.

Verification

Run-Pipeline.ps1's Test-DependencyTrackReadiness throws on a missing absolute HTTPS URL; both containerized pipelines fail closed in-container the same way. Run-Pipeline.sh is excluded from this requirement's scope -- it is a separate, unrelated LabVIEWCLI analysis tool with no Dependency-Track handling at all, not a native SBOM pipeline script.

Source

Software-Requirements-Specification

Priority

Medium

TestID

TEST-007

TestArtifact

Documented behavior; no regression test yet

CodeRef

README.md "Native SBOM reporting" section

Status

Planned (no automated test)