REQ 024

REQ-024: Native policy gate requires metrics bound to the exact BOM upload

Requirement

The native pipeline's policy gate shall fail a project if Dependency-Track's returned metrics are not confirmed fresh relative to the BOM import just uploaded.

Rationale

Prevents a stale or unrelated prior metrics snapshot from being mistaken for a clean result on a newly-uploaded SBOM.

Fit Criterion

Test-PipelinePolicyGate compares Metrics.lastOccurrence against a required-occurrence marker tied to the actual upload, rejecting metrics whose lastOccurrence is not strictly newer -- a timestamp-monotonicity freshness check, not a cryptographic or upload-token binding to the literal uploaded BOM bytes.

Verification

Code review of internal/Pipeline.Stages.ps1's Test-PipelinePolicyGate function and its caller in Publish-DependencyTrack.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-024

TestArtifact

Code review of the lastOccurrence vs required-occurrence comparison

CodeRef

internal/Pipeline.Stages.ps1 Test-PipelinePolicyGate module

Status

Verified (manual)