Add webhook event for compliance control status changes

Release notes

Add a compliance_control_status_changed webhook event that fires when a compliance control status changes (e.g., from pass to fail). This enables real-time alerting when projects fall out of compliance, without requiring API polling.

Problem to solve

Organizations using Compliance Frameworks need to know immediately when a project falls out of compliance. Currently:

  • No webhook event for compliance status changes (webhook events list has no compliance events)
  • No audit event for control status transitions (audit event types covers framework changes but not status changes)
  • No notification setting in Compliance Center

Customer feedback:

"Is there any kind of alerting when a Control Status goes from Pass to Fail?"

The only workaround is polling the GraphQL API (project.complianceControlStatus) on a schedule and comparing values between polls. This is inefficient and adds latency to compliance response.

Proposal

Add a compliance_control_status_changed webhook event with payload:

{
  "object_kind": "compliance_control_status",
  "event_type": "compliance_control_status_changed",
  "project": { "id": 123, "path_with_namespace": "group/project" },
  "control": {
    "id": 456,
    "name": "SAST Running",
    "control_type": "scanner_sast_running"
  },
  "previous_status": "pass",
  "current_status": "fail",
  "changed_at": "2026-02-05T12:00:00Z"
}

This would enable:

  • Real-time Slack/Teams notifications when compliance degrades
  • Integration with incident management systems (PagerDuty, Opsgenie)
  • Audit trail of compliance status changes over time
  • Automated remediation workflows

Intended users

Feature Usage Metrics

  • Count of webhooks configured with compliance_control_status_changed event enabled
  • Count of webhook deliveries for this event type
  • Delivery success/failure rate

Does this feature require an audit event?

No - this IS the alerting mechanism. The webhook event itself provides the audit trail.