REQ 029

REQ-029: Both container pipelines gate on Grype severity via GRYPE_FAIL_ON

Requirement

Both containerized SBOM pipelines (Linux and Windows) shall apply Grype's own findings as a real, configurable severity-threshold gate.

Rationale

A container run without a Dependency-Track backend configured still needs an independent vulnerability gate; this is a deliberate behavioral difference from the native pipeline (REQ-028), not an inconsistency.

Fit Criterion

GRYPE_FAIL_ON (default high) is read and enforced by both linux_sbom_pipeline.py and windows_sbom_pipeline.ps1, each documented in their own module docstring.

Verification

Code review of both container pipelines' own environment-variable documentation and gate-enforcement code.

Source

Software-Requirements-Specification

Priority

Medium

TestID

TEST-029

TestArtifact

Code review of both pipelines' own documented env-var gate enforcement

CodeRef

docker/linux-sbom/linux_sbom_pipeline.py, docker/windows-sbom/windows_sbom_pipeline.ps1 modules

Status

Verified (manual)