REQ 028

REQ-028: Native pipeline never gates on Grype's own findings

Requirement

The native pipeline shall not apply Grype's own scan findings as a pass/fail gate.

Rationale

Dependency-Track's own metrics are this pipeline's deliberate, single security gate; Grype's native-pipeline role is reporting only, avoiding two independent and potentially conflicting gates for the same SBOM.

Fit Criterion

Invoke-PipelineScanStage records the Grype stage's gate as not-gated explicitly, with an inline comment stating Dependency-Track metrics are the real gate.

Verification

Code review of internal/Pipeline.Stages.ps1's Invoke-PipelineScanStage function.

Source

Software-Requirements-Specification

Priority

Medium

TestID

TEST-028

TestArtifact

Code review of the explicit not-gated stage status

CodeRef

internal/Pipeline.Stages.ps1 Invoke-PipelineScanStage module

Status

Verified (manual)