Compliance framework cannot save changes when a requirement has five controls
Summary
Saving a compliance framework fails when a requirement already contains five controls. This happens when you try to remove an existing control or swap one control for another — for example, replacing "At least two approvals" with "At least one approval".
This was reproduced on GitLab.com
- Customer ticket: Zendesk #754146
- Product area: Compliance center → Compliance frameworks
Steps to reproduce
- Open a compliance framework that has a requirement with exactly five controls.
- Open the requirement's action menu and choose to edit it.
- Either remove one control, or replace an existing control (e.g. swap "At least two approvals" for "At least one approval").
- Save the requirement edit.
- Click Update framework.
A similar failure also happens when saving the framework without touching the five-control requirement at all.
Actual result
The framework update fails with an error like:
Error: Control 'scanner_sast_running': Failed to update compliance requirement control.
Error: Compliance requirement cannot have more than 5 controlsThe specific failing control varies — in a separate reproduction it was default_branch_protected. Either way, the change is not saved and the original five controls remain. Updating a framework with less than 5 controls works well
Expected result
A requirement that already has five controls should allow an existing control to be removed or modified, as long as the final state still has no more than five controls. The framework should save successfully.
Impact
Customers with compliance frameworks at the five-control limit are completely blocked from making any changes — they can't remove controls, adjust approval requirements, or do anything else that touches that requirement. This breaks normal day-to-day use of the Compliance center.
Environment
- Instance: GitLab.com
- Reproduced in: a test group with a requirement containing five controls