debian-mirror-gitlab/doc/user/compliance/compliance_report/index.md
2022-05-07 20:08:51 +05:30

12 KiB

type stage group info
reference, howto Manage Compliance To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments

Compliance report (ULTIMATE)

  • Introduced in GitLab 12.8 as Compliance Dashboard.
  • Renamed to compliance report in GitLab 14.2.

Compliance report gives you the ability to see a group's merge request activity. It provides a high-level view for all projects in the group. For example, code approved for merging into production.

You can use the report to:

  • Get an overview of the latest merge request for each project.
  • See if merge requests were approved and by whom.
  • See merge request authors.
  • See the latest CI/CD pipeline result for each merge request.

View the compliance report for a group

Prerequisites:

  • You must be an administrator or have the Owner role for the group.

To view the compliance report:

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Security & Compliance > Compliance report.

NOTE: The compliance report shows only the latest merge request on each project.

Merge request drawer

Introduced in GitLab 14.1.

When you select a row, a drawer is shown that provides further details about the merge request:

  • Project name and compliance framework label, if the project has one assigned.
  • Link to the merge request.
  • The merge request's branch path in the format [source] into [target].
  • A list of users that committed changes to the merge request.
  • A list of users that commented on the merge request.
  • A list of users that approved the merge request.
  • The user that merged the merge request.

Approval status and separation of duties

Introduced in GitLab 13.3.

We support a separation of duties policy between users who create and approve merge requests. The approval status column can help you identify violations of this policy. Our criteria for the separation of duties is as follows:

The Approval status column shows you at a glance whether a merge request is complying with the above. This column has four states:

State Description
Empty The merge request approval status is unknown
Failed The merge request does not comply with any of the above criteria
Warning The merge request complies with some of the above criteria
Success The merge request complies with all of the above criteria

If you see a non-success state, review the criteria for the merge request's project to ensure it complies with the separation of duties.

Chain of Custody report

Introduced in GitLab 13.3.

The Chain of Custody report allows customers to export a list of merge commits within the group. The data provides a comprehensive view with respect to merge commits. It includes the merge commit SHA, merge request author, merge request ID, merge user, pipeline ID, group name, project name, and merge request approvers. Depending on the merge strategy, the merge commit SHA can be a merge commit, squash commit, or a diff head commit.

To download the Chain of Custody report:

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Security & Compliance > Compliance report.
  3. Select List of all merge commits.

Commit-specific Chain of Custody Report

Introduced in GitLab 13.6.

You can generate a commit-specific Chain of Custody report for a given commit SHA.

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Security & Compliance > Compliance report.
  3. At the top of the compliance report, to the right of List of all merge commits, select the down arrow ({angle-down}).
  4. Enter the merge commit SHA, and then select Export commit custody report. SHA and then select Export commit custody report.

NOTE: The Chain of Custody report download is a CSV file, with a maximum size of 15 MB. The remaining records are truncated when this limit is reached.

Merge request violations

FLAG: On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to enable the feature flag named compliance_violations_report. On GitLab.com, this feature is not available. This feature is not ready for production use.

Merge request violations provide a view of all the separation of duties compliance violations that exist in projects in a specific group. For each separation of duties compliance violation, you can see:

  • A list of compliance violations.
  • The severity of each compliance violation.
  • Reason for the compliance violation.
  • A link to the merge request that caused the compliance violation.

Merge request violations can be accessed:

  • In the GitLab UI.
  • Using the GraphQL API (GitLab 14.9 and later).

View merge request violations

To view merge request violations:

  1. On the top bar, select Menu > Groups and find your group.
  2. On the left sidebar, select Security & Compliance > Compliance report.

Severity levels scale

The following is a list of available violation severity levels, ranked from most to least severe:

Icon Severity level
{severity-critical, 18, gl-fill-red-800} Critical
{severity-high, 18, gl-fill-red-600} High
{severity-medium, 18, gl-fill-orange-400} Medium
{severity-low, 18, gl-fill-orange-300} Low
{severity-info, 18, gl-fill-blue-400} Info

Violation types

The following is a list of violations that are either:

  • Already available.
  • Aren't available, but which we are tracking in issues.
Violation Severity level Category Description Availability
Author approved merge request High Separation of duties The author of the merge request approved their own merge request. Learn more. Unavailable
Committers approved merge request High Separation of duties The committers of the merge request approved the merge request they contributed to. Learn more. Unavailable
Fewer than two approvals High Separation of duties The merge request was merged with fewer than two approvals. Learn more. Unavailable
Pipeline failed Medium Pipeline results The merge requests pipeline failed and was merged. Unavailable
Pipeline passed with warnings Info Pipeline results The merge request pipeline passed with warnings and was merged. Unavailable
Code coverage down more than 10% High Code coverage The code coverage report for the merge request indicates a reduction in coverage of more than 10%. Unavailable
Code coverage down between 5% to 10% Medium Code coverage The code coverage report for the merge request indicates a reduction in coverage of between 5% to 10%. Unavailable
Code coverage down between 1% to 5% Low Code coverage The code coverage report for the merge request indicates a reduction in coverage of between 1% to 5%. Unavailable
Code coverage down less than 1% Info Code coverage The code coverage report for the merge request indicates a reduction in coverage of less than 1%. Unavailable