{"id":51674782,"url":"https://github.com/monch1962/compliance-platform","last_synced_at":"2026-07-15T04:04:05.892Z","repository":{"id":361571045,"uuid":"1254960674","full_name":"monch1962/compliance-platform","owner":"monch1962","description":"CI/CD compliance gate for Australian ISM and Essential Eight — checks K8s, Docker, and IaC via OPA/Rego policies","archived":false,"fork":false,"pushed_at":"2026-05-31T10:04:10.000Z","size":8659,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-31T10:11:36.188Z","etag":null,"topics":["australian-ism","compliance","conftest","devsecops","essential-eight","grc","iac-security","infrastructure-as-code","kubernetes","kubernetes-security","opa","policy-as-code","rego","security-policies","shift-left-security","soci-act"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/monch1962.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-31T08:05:27.000Z","updated_at":"2026-05-31T10:04:14.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/monch1962/compliance-platform","commit_stats":null,"previous_names":["monch1962/compliance-platform"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/monch1962/compliance-platform","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monch1962%2Fcompliance-platform","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monch1962%2Fcompliance-platform/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monch1962%2Fcompliance-platform/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monch1962%2Fcompliance-platform/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/monch1962","download_url":"https://codeload.github.com/monch1962/compliance-platform/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/monch1962%2Fcompliance-platform/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35489696,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-15T02:00:06.706Z","response_time":131,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["australian-ism","compliance","conftest","devsecops","essential-eight","grc","iac-security","infrastructure-as-code","kubernetes","kubernetes-security","opa","policy-as-code","rego","security-policies","shift-left-security","soci-act"],"created_at":"2026-07-15T04:04:05.230Z","updated_at":"2026-07-15T04:04:05.883Z","avatar_url":"https://github.com/monch1962.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Compliance Platform — CI/CD Gate\n\n[![CI](https://github.com/monch1962/compliance-platform/actions/workflows/ci.yml/badge.svg)](https://github.com/monch1962/compliance-platform/actions/workflows/ci.yml)\n![Go Version](https://img.shields.io/badge/Go-1.22-blue)\n![License](https://img.shields.io/badge/license-Apache%202.0-blue)\n\n**CI/CD Gate** checks your infrastructure-as-code against **Australian Essential Eight (E8) and ISM** compliance policies — directly from your CI pipeline.\n\nBuilt by [Civvra](https://civvra.com). The hosted API is available at [RegoHub](https://regohub.com).\n\nIt wraps [conftest](https://github.com/open-policy-agent/conftest) and [OPA/Rego](https://www.openpolicyagent.org/) to provide:\n\n- **Privilege \u0026 security controls** — privileged containers, host namespace access, capabilities\n- **Image security** — digest pinning, no `latest` tags, imagePullPolicy\n- **Secrets detection** — hardcoded AWS keys, password variables without `sensitive=true`\n- **Network security** — Ingress TLS, exposed ports, service exposure\n- **Storage controls** — hostPath volumes, secret injection patterns\n- **Socratic mode** — every violation shows framework IDs, tier labels, and remediation hints\n\n\u003e **Supported frameworks:** ISM (Information Security Manual) • Essential Eight • SOCI Act  \n\u003e **Verification tiers:** L1 (Machine-Verified) • L2 (Evidence-Assisted) • L3 (Process-Mapped) • L4 (Advisory)  \n\u003e **Currently shipped:** L1 — E8 + ISM E8 ML1 baseline (55 rules, 13 policy files)\n\n![cicd-gate demo output](docs/cicd-gate-demo.png)\n\n---\n\n## Legal Disclaimer\n\n**CI/CD Gate is a compliance posture monitor — not a compliance certification.**\n\nThis tool evaluates infrastructure-as-code against published compliance frameworks using automated Rego policies. It provides:\n\n- ✅ Automated posture checking against machine-testable controls\n- ✅ Framework-identified violation reporting (ISM, E8, SOCI)\n- ✅ Tier-labelled verification levels (L1-L4)\n\nIt does NOT provide:\n\n- ❌ A formal compliance audit or certification\n- ❌ Qualified IRAP assessor services\n- ❌ Legal advice on regulatory obligations\n\n**Tier L1** controls are machine-verified. **Tiers L2-L4** provide coverage monitoring and evidence collection — not certification.\n\n*Use at your own risk. Free and open-source software (Apache 2.0).*\n\n---\n\n## Prerequisites\n\n- **conftest** — the CLI wraps [conftest](https://github.com/open-policy-agent/conftest) to evaluate OPA/Rego policies\n  ```bash\n  # macOS\n  brew install conftest\n\n  # Linux (via Linuxbrew)\n  brew install conftest\n\n  # Or download from https://github.com/open-policy-agent/conftest/releases\n  ```\n- **Go 1.21+** (only needed for `go install` method below)\n\n## Quick Start\n\n```bash\n# Install via Homebrew (macOS/Linux)\nbrew tap monch1962/tap\nbrew install cicd-gate\n\n# Or install via Go (requires Go 1.21+)\ngo install github.com/monch1962/compliance-platform/packages/cicd-gate@latest\n\n# Or download from GitHub Releases\n# https://github.com/monch1962/compliance-platform/releases\n\n# pip package coming soon (locked out of PyPI, will publish when access restored)\n\n# Verify it works\ncicd-gate version\n```\n\n## Usage\n\n```bash\n# Generate a config file (includes legal disclaimer)\ncicd-gate init\n\n# Scan the current directory\ncicd-gate scan .\n\n# Scan with verbose remediation hints (framework IDs, tier labels, remediation)\ncicd-gate scan . --socratic\n\n# Scan with compliance pack filter (only show E8 or ISM controls)\ncicd-gate scan . --socratic --pack essential-eight\ncicd-gate scan . --socratic --pack ism-baseline\n\n# Check ASD ISM catalog for changes since last check\ncicd-gate ism-diff\n\n# Scan a specific directory with custom policies\ncicd-gate scan ./infra --policy ./custom-policies\n```\n\n## GitHub Action\n\nAdd to `.github/workflows/compliance.yml`:\n\n```yaml\nname: Compliance Check\non: [pull_request]\njobs:\n  compliance:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: monch1962/compliance-platform@v0.3.3\n```\n\n## Policies\n\n### Currently Shipped (L1 Machine-Verified)\n\n| Policy | ID | Rules | Frameworks | Tier |\n|---|---|---|---|---|\n| K8s Security | K8S-SEC-* | 12 | ISM-0445, ISM-1175, ISM-1380, ISM-1688, ISM-1689, E8 #2, #6 | L1 |\n| K8s IAM | K8S-IAM-* | 9 | ISM-0445, ISM-1175, ISM-1883, E8 #6 | L1-L2 |\n| K8s Network | K8S-NET-* | 5 | ISM-1401, ISM-1504, E8 #5 | L1-L2 |\n| K8s Storage | K8S-STO-* | 3 | ISM-0445, E8 #6 | L1-L2 |\n| K8s App Control | E8-AC-* | 3 | ISM-0843, ISM-1657, ISM-1870, E8 #1 | L1 |\n| K8s Patch OS | E8-OS-* | 3 | ISM-1690, ISM-1694, ISM-1877, E8 #7 | L1-L2 |\n| K8s Backup | E8-BK-* | 6 | ISM-1511, ISM-1810, ISM-1811, E8 #8 | L2 |\n| K8s EOL Support | CESS-* | 5 | ISM-1501, ISM-1704, ISM-1905, E8: Cessation of Support | L1 |\n| K8s Vuln Scan | VULN-* | 3 | ISM-1698, ISM-1699, ISM-1876, E8: Scanning | L1-L2 |\n| Docker | DKR-* | 4 | ISM-1690, ISM-1694, E8 #2 | L1-L2 |\n| Secrets | SEC-* | 2 | ISM-0445, ISM-1175, E8 #6 | L1 |\n\n**Total: 55 rules across 13 policy files — 5 of 8 E8 strategies automated (E8 #3, #4 need manual attestation)**\n\nISM control IDs sourced from ASD's official OSCAL catalog (March 2026), E8 ML1 baseline profile.\n\n### Roadmap\n\nL2-L4 controls (full ISM, SOCI, CPS 234, TSSR, PSPF, APPs) are in development.\n\n## Output Format\n\n```\n$ cicd-gate scan . --socratic\n\nCI/CD Gate — Compliance Posture Monitor\nFrameworks: ISM | E8 | SOCI\nTier: L1 (Machine-Verified)\nLegal: This is a posture monitor, not a certification.\n\n✖ K8S-SEC-001: Container \"app\" runs privileged\n   [ISM-1172] [E8: Restrict Admin Privileges (ML2)] [Tier: L1]\n   Fix: set securityContext.privileged: false\n\n✓ K8S-SEC-003: Container \"web\" sets runAsNonRoot: true\n\nSummary:\n  3 failed, 30 passed, 33 total (L1: 30/30)\n```\n\n## Development\n\n```bash\n# Run tests\ncd packages/cicd-gate \u0026\u0026 go test ./...\n\n# Test policies\nopa test packages/policies/ -v\n\n# Scan demo fixtures\nconftest test demo/k8s/ --policy packages/policies/\n\n# Build\ncd packages/cicd-gate \u0026\u0026 go build -o cicd-gate .\n```\n\n## License\n\nApache 2.0 — Use at your own risk. This tool is not a substitute for a formal compliance audit.\n\nSee [LICENSE](LICENSE) for full terms.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonch1962%2Fcompliance-platform","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmonch1962%2Fcompliance-platform","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmonch1962%2Fcompliance-platform/lists"}