Working with Compliance and Governance

1. Implementing Compliance Frameworks

Example: GitLab CI/CD Compliance Configuration

stages:
  - build
  - test
  - compliance

compliance_check:
  stage: compliance
  image: <registry>/compliance-checker:latest
  script:
    - /usr/local/bin/compliance-checker --config /etc/compliance/config.yaml
  artifacts:
    reports:
      compliance: compliance-report.json

Framework	Description	Integration Method	Status
SOC 2 Type 2	Security, availability, processing integrity, confidentiality, and privacy	Automated audit logs via GitLab's built-in compliance features	NEW
ISO 27001	Information security management system (ISMS) framework	Integration with GitLab's audit trail and access controls	DEPRECATED
NIST CSF	National Institute of Standards and Technology Cybersecurity Framework	Custom compliance scripts using GitLab CI/CD pipelines	BETA

Note: Ensure all compliance checks are run in a secure environment with proper access controls to prevent unauthorized modifications.

Warning: GitLab CI/CD does not automatically enforce compliance rules; it only reports findings. Manual review and approval steps are required for compliance validation.

2. Using Compliance Pipeline Configuration

Property	Values	Description
compliance.enabled	`true` \| `false`	Enables or disables the compliance pipeline feature.
compliance.rules	Array of rule objects	Defines the compliance rules to be enforced.
compliance.report_format	`json` \| `xml`	Specifies the format of the compliance report output.

Example: Enabling Compliance Pipeline

include:
  - "compliance.yml"

variables:
  compliance.enabled: "true"
  compliance.report_format: "json"

Example: Defining Compliance Rules

compliance:
  rules:
    - name: "License Check"
      description: "Ensure all dependencies are licensed under MIT or Apache-2.0"
      command: "license-checker --allowed MIT Apache-2.0"
    - name: "Security Scan"
      description: "Scan for known vulnerabilities in dependencies"
      command: "npm audit --audit-level high"

3. Configuring Separation of Duties

Setting	Description	Default
access_level	Defines user access levels for compliance roles	Developer
group_access	Controls group-level access permissions	None
project_access	Manages project-level access controls	None

Example: Setting up Separation of Duties

variables:
  COMPLIANCE_ROLE: "compliance"
  AUDIT_ROLE: "audit"

stages:
  - compliance
  - audit

compliance_check:
  stage: compliance
  script:
    - echo "Running compliance checks"
  only:
    variables:
      - $COMPLIANCE_ROLE

audit_check:
  stage: audit
  script:
    - echo "Running audit checks"
  only:
    variables:
      - $AUDIT_ROLE

Note: Ensure that users assigned to compliance roles have appropriate permissions to execute checks without affecting other project components.

4. Implementing Approval Rules

Rule Type	Description	Configuration	Notes
Approval Rule	Defines who can approve a pipeline or job	`approvals_required: 2`	Can be set per project or group
User/Group Approval	Approvals from specific users or groups	`rules:` `- if: $CI_PIPELINE_SOURCE == 'merge_request'` `approvals_required: 1`	Supports multiple approvers
Approval Status	Indicates approval state of a job or pipeline	`status: approved`	Can be checked via API or UI

Example: Configuring Approval Rules in .gitlab-ci.yml

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request'
      approvals_required: 2

job:
  script:
    - echo "Running job"
  only:
    - merge_requests

Note: Approval rules are enforced at the project or group level and can be overridden per job using approvals_required.

Warning: If no approval rules are configured, jobs will run without manual intervention.

5. Using Audit Events

Event Type	Description	Fields	Notes
group_access	Access to a group	`group_id`, `user_id`, `access_level`	Tracked when user accesses a group
project_access	Access to a project	`project_id`, `user_id`, `access_level`	Tracked when user accesses a project
pipeline_create	Pipeline creation	`pipeline_id`, `user_id`, `project_id`	Tracked when a new pipeline is created
job_create	Job creation	`job_id`, `user_id`, `project_id`	Tracked when a new job is created
variable_create	Variable creation	`variable_key`, `user_id`, `project_id`	Tracked when a new variable is created

Example: Audit Event Configuration

audit_events:
  enabled: true
  log_level: info

Note: Audit events are only available in GitLab Premium and above.

Warning: Enabling audit events can increase log volume significantly. Ensure adequate storage and processing capacity.

6. Configuring License Compliance

Setting	Description	Default	Notes
license_compliance.enabled	Enables or disables license compliance checks	`false`	Requires GitLab Premium or Ultimate
license_compliance.allowlist	List of allowed licenses	`[]`	Empty list means all licenses are allowed
license_compliance.blocklist	List of blocked licenses	`[]`	Overrides allowlist if set
license_compliance.violation_action	Action taken when a license violation is detected	`none`	Options: `none`, `block`, `warn`

Example: License Compliance Configuration

license_compliance:
  enabled: true
  allowlist:
    - MIT
    - Apache-2.0
  blocklist:
    - GPL-3.0
  violation_action: block

Note: License compliance checks are performed during pipeline execution and can be configured at the project, group, or instance level.

7. Implementing Security Policies

Policy Type	Description	Configuration	Notes
Security Scanning	Automated scanning of code and dependencies for vulnerabilities	`security:` block in `.gitlab-ci.yml`	Integrates with tools like SAST, DAST, Dependency Scanning
Compliance Checks	Enforces adherence to organizational and regulatory standards	`compliance:` block in `.gitlab-ci.yml`	Can include checks for license compliance, code quality standards
Access Control	Manages permissions and access to CI/CD resources	`access_control:` block in `.gitlab-ci.yml`	Enforces role-based access control (RBAC) for pipelines

Example: Security Scanning Configuration

security:
  sast:
    enabled: true
    config_file: .gitlab/sast-config.yml
  dependency_scanning:
    enabled: true
    config_file: .gitlab/dependency-scanning-config.yml

Example: Compliance Check Configuration

compliance:
  license_check:
    enabled: true
    allowed_licenses:
      - MIT
      - Apache-2.0
    blocked_licenses:
      - GPL-3.0

Note: Security policies can be enforced at the project, group, or instance level using GitLab's built-in compliance features.

8. Using Compliance Dashboards

Example: Setting up a compliance dashboard in GitLab

dashboard:
  stage: compliance
  script:
    - echo "Running compliance checks..."
    - gitlab-compliance-report --output-format json
  artifacts:
    reports:
      compliance: compliance.json

Dashboard Component	Description	Configuration
compliance.metrics	Metrics for compliance status	`enabled: true`
compliance.reports	Reports generated from checks	`format: json`
compliance.alerts	Alerts for policy violations	`threshold: critical`

Note: Compliance dashboards require GitLab Premium or Ultimate license.

Warning: Ensure that compliance data is protected with appropriate access controls.

Key Features of Compliance Dashboards

Real-time visibility into compliance status
Automated policy enforcement
Integration with audit logs
Customizable alerting rules

9. Configuring External Status Checks

Property	Description	Default Value	Notes
external_status_checks.enabled	Enables or disables external status checks integration	`false`	Set to `true` to enable integration with external tools
external_status_checks.url	URL of the external status check service	`null`	Must be a valid HTTPS endpoint
external_status_checks.token	Authentication token for external service	`null`	Required if authentication is needed

Example: Enable External Status Checks

external_status_checks:
  enabled: true
  url: https://example.com/webhook
  token: "secret-token"

Note: External status checks are only available in GitLab Premium and Ultimate editions.

Warning: Ensure the external service URL is accessible from GitLab runners to avoid pipeline failures.

10. Implementing Change Management Controls

Control Type	Description	Implementation	Notes
Branch Protection Rules	Prevent unauthorized changes to protected branches	`branch_protection: rules: - name: "main" target: "branch" required_status_checks: - "build"`	Enforces required checks before merge
Merge Request Approval	Require approvals before merging changes	`merge_request: approvals: required: 2 report_path: "coverage.xml"`	Can be enforced per project or group
Code Review Policies	Enforce code review requirements for changes	`code_review: required: true min_approvals: 1`	Requires at least one review before merge

Example: Enforcing Branch Protection

branch_protection:
  rules:
    - name: "main"
      target: "branch"
      required_status_checks:
        - "build"
        - "test"
      required_pull_request:
        enabled: true

Example: Setting Merge Request Approvals

merge_request:
  approvals:
    required: 2
    report_path: "coverage.xml"
    allow_approvals_from_maintainers: true

Note: These controls can be configured at the project or group level in GitLab.

Warning: Ensure that approval rules do not block legitimate contributions or create bottlenecks in development workflows.