• View the compliance report for a group
  • Severity levels scale
  • Violation types
• Merge request drawer
• Separation of duties
• Chain of Custody report
  • Commit-specific Chain of Custody report

Compliance report

Compliance report gives you the ability to see a group’s merge request activity. It provides a high-level view for all projects in the group. For example, code approved for merging into production.

You can use the report to get:

• A list of compliance violations from all merged merge requests within the group.
• The reason and severity of each compliance violation.
• A link to the merge request that caused each compliance violation.

View the compliance report for a group

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To view the compliance report:

1. On the top bar, select Main menu > Groups and find your group.
2. On the left sidebar, select Security & Compliance > Compliance report.

Severity levels scale

The following is a list of available violation severity levels, ranked from most to least severe:

Violation types

The following is a list of violations that are either:

• Already available.
• Aren’t available, but which we are tracking in issues.

Merge request drawer

When you select a row, a drawer is shown that provides further details about the merge request:

• Project name and compliance framework label, if the project has one assigned.
• Link to the merge request.
• The merge request’s branch path in the format [source] into [target].
• A list of users that committed changes to the merge request.
• A list of users that commented on the merge request.
• A list of users that approved the merge request.
• The user that merged the merge request.

Separation of duties

We support a separation of duties policy between users who create and approve merge requests. Our criteria for the separation of duties is as follows:

• A merge request author is not allowed to approve their merge request
• A merge request committer is not allowed to approve a merge request they have added commits to
• The minimum number of approvals required to merge a merge request is at least two

Chain of Custody report

The Chain of Custody report allows customers to export a list of merge commits within the group. The data provides a comprehensive view with respect to merge commits. It includes the merge commit SHA, merge request author, merge request ID, merge user, date merged, pipeline ID, group name, project name, and merge request approvers. Depending on the merge strategy, the merge commit SHA can be a merge commit, squash commit, or a diff head commit.

With the all_commits_compliance_report flag enabled, the Chain of Custody report provides a 1 month trailing window of any commit into a project under the group.

To generate the report for all commits, GitLab:

1. Fetches all projects under the group.
2. For each project, fetches the last 1 month of commits. Each project is capped at 1024 commits. If there are more than 1024 commits in the 1-month window, they are truncated.
3. Writes the commits to a CSV file. The file is truncated at 15 MB because the report is emailed as an attachment.

The expanded report includes the commit SHA, commit author, committer, date committed, the group, and the project. If the commit has a related merge commit, then the following are also included:

• Merge commit SHA.
• Merge request ID.
• User who merged the merge request.
• Merge date.
• Pipeline ID.
• Merge request approvers.

To generate the Chain of Custody report:

1. On the top bar, select Main menu > Groups and find your group.
2. On the left sidebar, select Security & Compliance > Compliance report.
3. Select List of all merge commits.

The Chain of Custody report is either:

• Available for download.
• Sent through email. Requires GitLab 15.5 and later.

Commit-specific Chain of Custody report

Authenticated group owners can generate a commit-specific Chain of Custody report for a given commit SHA, either:

• Using the GitLab UI:

  1. On the top bar, select Main menu > Groups and find your group.
  2. On the left sidebar, select Security & Compliance > Compliance report.
  3. At the top of the compliance report, to the right of List of all merge commits, select the down arrow ().
  4. Enter the merge commit SHA, and then select Export commit custody report. SHA and then select Export commit custody report.

The Chain of Custody report is either:

• Available for download.

• Sent through email. Requires GitLab 15.5 and later.

• Using a direct link: https://gitlab.com/groups/<group-name>/-/security/merge_commit_reports.csv?commit_sha={optional_commit_sha}, passing in an optional value to the commit_sha query parameter.