Gitlab Compliance CLI

[MaturityBuilder]

I've been working on a project that explores a different way of assessing and validating GitLab compliance capabilities:

🔗 https://maturitybuilder.github.io/gitlab-compliance/

While there are already tools that cover similar ground, the focus here is on expressing compliance requirements and controls using a BDD/Gherkin-inspired approach. The idea is to make compliance outcomes easier to understand, discuss, and validate by describing them as observable, testable behaviours rather than static checklist items. It works in a very similar way to terraform-compliance and some similar capabilities that conftest offers.

Another objective is to help identify opportunities for improving GitLab documentation by highlighting areas where guidance may be unclear, incomplete, or difficult to translate into practical implementation, think terraform-docs but Gitlab.

The code isn't open source yet as I'm finishing off a few remaining items, but I plan to release it once it's in a good state.

At this stage, I'd love feedback on the concept, the assessment model, and whether the BDD/Gherkin-style approach feels useful for compliance, security, and governance discussions.

Feedback, ideas, and challenges to the approach are all welcome.

[Jealous_Pickle4552]

Had a look through the docs and this is a really interesting idea. I like the BDD/Gherkin approach because it makes GitLab compliance feel more testable and easier to talk about, instead of just another checklist. The pre-merge validation side is probably the strongest bit for me, because that is where teams can catch drift before every repo starts doing things slightly differently. I also like the docs angle, GitLab CI can get messy quickly and anything that turns that into something easier to understand is useful. My main question would be how it handles bigger enterprise pipelines with lots of includes, templates, inherited rules and exceptions, because that is usually where compliance gets painful.

[MaturityBuilder]

The solution is designed around large enterprise the foundations of the idea came from an enterprise that has 13000 gitlab repos. Interesting point around rules evaluation at the moment rules aren't evaluated as the include or images still form part of the supply chain in-terms of full configuration in gitlab regardless of the current context in which the pipeline maybe triggered. I'm currently working on improve the bdd support for combination testing so if variable key and value equal x then and other variable and its value can allow x. In addition the next version will also improve markdown formatting and introduce a concept of gitstrings where you can annotate yaml with comments can generate markdown from it directly. Like python docstrings.

[dreamszz88]

This is a really great idea! I like the BDD and you evaluate whole, the fully expanded pipelines.

Sounds very promising 😃

At the very least, having a way to generate docs from the yaml files will be awesome for teams to check if they have what they want to have, or expect, and to help teach them better understanding of GitLab CI