Compliance controls should show success/failed based on scan completion regardless of pipeline status

Problem

The compliance framework is not displaying the correct control compliance status in some scenarios. Specifically:

  • Compliance controls currently only show success/failed on successfully run pipelines (default branch only)
  • Even when SAST, Secret, and Container scans are executed successfully, the compliance framework can incorrectly mark these controls as failing if the overall pipeline fails
  • This creates confusion for users who expect the compliance status to reflect whether security scans ran and completed, not whether the entire pipeline passed

Current Behavior

  • Compliance controls scan every 12 hours
  • Scanner controls require the project to have a passing pipeline on the default branch
  • If the pipeline fails (even with successful security scans), controls show as failing

Desired Behavior

Users would like to see:

Success/failed controls based solely on scan completion - regardless of overall pipeline status

Edited by Nate Rosandich