ci: adopt reference conformance scaffolding

Andrew Dunnrequested to merge
ci/reference-conformance into master

Summary

Adds reference conformance scaffolding against gitlab-com/public-sector/reference, pinned to v1.2.0, in report phase (non-blocking).

What changed

  • .reference.yaml: reference_version: v1.2.0, adoption_phase: report, applicable_standards: all, no exemptions.
  • Root CODEOWNERS, built from the reference repo's CODEOWNERS template. The optional default rule covers @andunn and @britchie2 (Bryan Ritchie's GitLab handle). Required sections gate legal and policy content (LICENSE, CONTRIBUTING.md), brand assets (avatar.svg, hero.svg, favicon.svg, landing in a parallel MR), and CI configuration (.gitlab-ci.yml, .gitlab/, templates/).
  • conformance job in the security stage of .gitlab-ci.yml. Clones the reference repo at the same v1.2.0 tag and runs just -f /reference/justfile check REPO=$CI_PROJECT_DIR. allow_failure: true matches the report-phase posture.
  • CHANGELOG entry under Unreleased / Added.

How to review

The pipeline will show red on stig::verify-creds: a pre-existing Duo CLI entitlement gap, unrelated to this change. The new conformance job surfaces findings against the reference standards during report phase without gating merge, by design.

Merge request reports