C

Compliance

The conformance contract for projects under gitlab-com/public-sector.

AI-powered GitLab CI Component that automates DISA ASD STIG compliance analysis reducing manual checklist completion from weeks or months to minutes using GitLab Duo agentic workflows to determine compliance with the 286 security controls.

The policy plane. Pipeline Execution Policy, security policies, and external compliance controls that assess and gate every consumer.

A suite of tools to assist with reviewing Open Source Software dependencies. (Mirrored from https://github.com/oss-review-toolkit/ort)

Compliance service enforcing rules defined in the TrustFramework - Architecture Document/Compliance Document

Bedrock RMF — self-hosted NIST 800-53 Rev 5 / RMF compliance management (an eMASS / Xacta alternative): control implementations to the CCI, POA&Ms, evidence, HW/SW inventory, PPSM, STIG checklists, cloud inheritance. AGPL-3.0.

Maintenance, asset, and configuration-change records for accredited systems. Single static binary, pure-Go SQLite, LDAP/AD auth with local break-glass accounts, hash-chained audit trail. AGPL-3.0-or-later.

Landing page for the Evidence Factory group. Start here for the guided walk through the six projects.

Consumer workload: a reusable CI/CD Catalog component. Adoption phase enforce, so an off-catalog include is blocked. The red pipeline is deliberate: the gap is planted so a reader can watch the gate stop it.

Consumer workload: a container image. Adoption phase cutover, so the regulatory baseline blocks an unsigned image. The red pipeline is deliberate: the gap is planted so a reader can watch the gate stop it.

BalanceSeal is an AGPL 3.0+ cryptographic audit module for cryptocurrency exchanges and digital wallets that generates a verifiable, time-frozen snapshot of all user assets at the moment an account is terminated. It aggregates on-chain and off-chain balances, reconciles holdings across systems, locks market pricing at the termination timestamp, and produces tamper-evident reports for compliance, auditing, and transparency. https://roxanneardary.com/balanceseal/

A Python-based CLI tool designed to scan GitLab projects for compliance against the CIS GitLab Benchmark. Check out the recommendations-as-code in this repo. Read the docs for more info.

CLI tool for GitLab automation: sync groups to local filesystem and audit projects against security & OpenSSF best practices with automated scoring

Public architecture and implementation guides for enterprise data classification, sensitive data discovery, DSPM and data loss prevention by Siberson.

Consumer workload: a Go binary. Adoption phase report, so conformance runs advisory and merge requests stay green.

The driver. One tool that provisions the group, applies the NIST 800-53 framework, pushes control evidence, and exports the control allocation as an OSCAL component-definition.

The evidence line and the published CI/CD Catalog. Governed, reusable pipeline components every workload builds from.

Pi extension wrapping Vladimir Glafirov's gitlab-ai-provider. Exposes GitLab Duo's AIGW catalog to Pi with two routing paths: agenticChat (full tool calling) and workflowChat (Bedrock + Vertex compliance routing of Claude).

GitPatrol is an open-source AI platform that automatically enforces license compliance, tracks contributor attribution, and generates minimal, token-efficient files for Git repositories. It scans code, documentation, and dependencies for violations, suggests safe fixes, and integrates with CI/CD pipelines to keep projects legally safe and fully compliant. https://roxanneardary.com/gitpatrol/

PHITrack is an open-source platform that monitors, analyzes, and visualizes PHI (Protected Health Information) transmissions using AI-driven insights while maintaining human-in-the-loop oversight. It provides dashboards, alerts, predictive risk scoring, and synthetic dataset simulations to ensure HIPAA-safe compliance, training, and reporting. https://roxanneardary.com/phitrack/