# Dependency-Track policy violation fails the CI upload gate

> Fix a CI step failing after uploading an SBOM to Dependency-Track - a license (or security) policy violation on the project causes the pipeline gate to fail.

Source: https://latchkey.dev/learn/ci-integrations/dependency-track-policy-violation-fails-ci  
Updated: 2026-06-30

Your CI uploaded an SBOM (often generated by cdxgen) to Dependency-Track, and after analysis a policy condition (for example a banned license) was violated, so the CI gate that checks project status failed the build.

## Make the gate meaningful

- Fail the build on the severity you actually intend to block, and set it explicitly. A scanner that reports without failing is documentation, not a gate.
- Scan the artifact you ship, not the source tree. A vulnerability in a base image will not appear in a source scan.
- Pin the scanner version and its database snapshot for reproducibility, then update deliberately; a floating database turns an unrelated push into a red build.
- Give the job a way to record accepted risk, or people will disable the gate rather than triage it.

## FAQ

### What causes Dependency-Track policy violation fails the CI upload gate?

There are 2 common causes: a component license breaches a dependency-track policy and the gate reads project status too early. A policy condition of type License (or License Group) matches a component in the uploaded SBOM, producing a FAIL-level violation that your gate treats as a failure.

### How do I fix Dependency-Track policy violation fails the CI upload gate?

There are 2 fixes depending on which cause you have: resolve or suppress the violation and wait for processing before gating. Work through them in order, since the first is the most common.

### What does Dependency-Track policy violation fails the CI upload gate actually mean?

The upload succeeds but the follow-up gate reports policy violations for the project, listing the component and the license (or vulnerability) that breached a policy, and exits non-zero.

### How do I stop Dependency-Track policy violation fails the CI upload gate happening again?

Keep Dependency-Track license policies aligned with legal requirements. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt