DevOps Pipeline as Code: Automating Compliance Checks

In today's fast-paced software development landscape, speed is king. But cutting corners on security and compliance can lead to disastrous consequences. Imagine launching a new feature only to discover it violates GDPR regulations, resulting in hefty fines and reputational damage. Or worse, a security vulnerability introduced through a rushed deployment leads to a data breach. The solution? Automating compliance checks directly within your DevOps pipeline. This isn't just about ticking boxes; it's about building security and compliance into the very fabric of your software development lifecycle. Choosing the right devops tools is crucial for achieving this.

For years, compliance was often an afterthought, a stage tacked on at the end of the development process. This resulted in friction, delays, and ultimately, less secure applications. Now, with the rise of "Pipeline as Code," we can embed compliance checks directly into our CI/CD pipelines, ensuring that every build, every deployment, and every change adheres to our defined standards. This shift requires a careful selection of devops tools that are not only powerful but also easily integrated and automated. We need to move beyond manual audits and embrace a continuous compliance approach.

This article dives deep into the world of automating compliance within a DevOps pipeline using "Pipeline as Code." We'll explore the challenges, the benefits, and the specific devops tools and techniques you can use to build secure, compliant applications. We'll move beyond simply automating deployments and look at how to weave security and compliance checks directly into your workflow. I'll share my own experiences testing various solutions, highlighting their strengths and weaknesses, and providing practical advice on how to implement a successful compliance-as-code strategy. The right devops tools can truly transform your development process.

What You'll Learn

• Understand the importance of automating compliance in DevOps.
• Explore the concept of "Pipeline as Code" and its role in compliance.
• Identify the key components of a compliance-as-code pipeline.
• Learn how to integrate security and compliance checks into your CI/CD process.
• Compare different devops tools for automating compliance.
• See a real-world example of a compliance-as-code implementation.
• Discover best practices for building secure, compliant applications.

Table of Contents

• Why Automate Compliance in DevOps?
• Pipeline as Code: The Foundation for Automated Compliance
• Key Components of a Compliance-as-Code Pipeline
• Integrating Security and Compliance Checks
• Comparing DevOps Tools for Compliance Automation
• Policy as Code: Defining Your Compliance Rules
• Infrastructure as Code (IaC) and Compliance
• Container Security and Compliance
• Cloud Compliance Considerations
• Real-World Example: Automating GDPR Compliance
• Best Practices for Compliance-as-Code
• Troubleshooting Common Compliance Issues
• Frequently Asked Questions (FAQ)
• Conclusion: Building a Secure and Compliant Future

Why Automate Compliance in DevOps?

Manual compliance checks are slow, error-prone, and often performed too late in the development cycle. This can lead to costly rework, delays in release cycles, and increased risk of security vulnerabilities. Automating compliance offers several key advantages:

• Increased Speed and Efficiency: Automating compliance checks allows you to identify and resolve issues earlier in the development process, reducing the time and effort required to achieve compliance.
• Reduced Risk: Automated checks can help you identify and mitigate security vulnerabilities and compliance violations before they make it into production.
• Improved Consistency: Automated checks ensure that all code and infrastructure changes are consistently evaluated against your defined compliance standards.
• Enhanced Visibility: Automated compliance dashboards provide real-time visibility into the compliance status of your applications and infrastructure.
• Lower Costs: By reducing rework, preventing security breaches, and streamlining the compliance process, automation can significantly lower your overall costs.

The Cost of Non-Compliance

The cost of non-compliance can be substantial. According to a 2025 report by Ponemon Institute, the average cost of a data breach is $4.6 million. This figure doesn't even include the potential fines and penalties associated with regulatory violations. For example, GDPR fines can reach up to 4% of a company's annual global turnover or €20 million, whichever is higher. The financial impact of non-compliance underscores the importance of investing in automated compliance solutions.

Moreover, the reputational damage caused by a security breach or compliance violation can be even more devastating. Customers may lose trust in your organization, leading to a decline in sales and brand value. Automating compliance is therefore not just about avoiding fines; it's about protecting your business and your reputation.

The Shift to Continuous Compliance

The traditional approach to compliance, where checks are performed only at the end of the development cycle, is no longer sufficient. The modern DevOps approach requires a shift to continuous compliance, where compliance checks are integrated into every stage of the development process. This means that every code commit, every infrastructure change, and every deployment is automatically evaluated against your defined compliance standards. This proactive approach helps to identify and resolve issues early on, reducing the risk of costly rework and security breaches.

Pipeline as Code: The Foundation for Automated Compliance

Pipeline as Code (PaC) is the practice of defining your CI/CD pipelines using code, rather than relying on manual configuration through a GUI. This allows you to version control your pipelines, automate their creation and management, and treat them as first-class citizens in your software development lifecycle. PaC is a critical enabler for automated compliance because it allows you to embed compliance checks directly into your pipeline definition.

Tools like Jenkins, GitLab CI, Azure DevOps Pipelines, and CircleCI all support PaC. These devops tools allow you to define your pipeline using a declarative language such as YAML or Groovy. This code defines the stages of your pipeline, the tasks that are executed in each stage, and the dependencies between stages. By embedding compliance checks into your pipeline definition, you can ensure that every build, every deployment, and every change adheres to your defined standards. For example, in GitLab CI, you can use the `rules` keyword to define conditions under which certain jobs are executed. This can be used to skip compliance checks for certain branches or environments, but it's generally recommended to run compliance checks on all changes.

Benefits of Pipeline as Code for Compliance

• Version Control: Pipeline definitions are stored in version control, allowing you to track changes, revert to previous versions, and collaborate with your team.
• Automation: Pipelines can be automatically created and managed using infrastructure-as-code tools such as Terraform or CloudFormation.
• Repeatability: Pipelines can be easily replicated across different environments, ensuring consistency and reducing the risk of errors.
• Auditing: Pipeline definitions are auditable, providing a clear record of all changes made to your CI/CD process.
• Compliance Integration: Compliance checks can be seamlessly integrated into the pipeline definition, ensuring that every build and deployment adheres to your defined standards.

Choosing the Right Pipeline as Code Tool

The choice of PaC tool depends on your specific needs and requirements. Some popular options include:

• Jenkins: A widely used open-source automation server with a vast ecosystem of plugins.
• GitLab CI: A built-in CI/CD solution tightly integrated with the GitLab platform.
• Azure DevOps Pipelines: A cloud-based CI/CD service offered by Microsoft Azure.
• CircleCI: A cloud-based CI/CD platform with a focus on speed and ease of use.

When evaluating these devops tools, consider factors such as ease of use, scalability, integration with your existing tools, and the availability of plugins for compliance automation. For example, Jenkins has a large number of plugins for security scanning and compliance reporting, but configuring these plugins can be complex. GitLab CI offers a more streamlined experience, but it may not have as many plugins available. I've personally found Azure DevOps Pipelines to be a good balance between power and ease of use, especially when working with Microsoft Azure services. However, the pricing can be a bit complex depending on the number of pipelines and parallel jobs you need.

Key Components of a Compliance-as-Code Pipeline

A compliance-as-code pipeline typically consists of the following key components:

• Source Code Management (SCM): A repository for storing your source code, such as Git.
• CI/CD Tool: A tool for automating the build, test, and deployment process, such as Jenkins, GitLab CI, or Azure DevOps Pipelines.
• Static Analysis Security Testing (SAST) Tool: A tool for analyzing source code for security vulnerabilities, such as SonarQube or Checkmarx.
• Dynamic Application Security Testing (DAST) Tool: A tool for testing running applications for security vulnerabilities, such as OWASP ZAP or Burp Suite.
• Software Composition Analysis (SCA) Tool: A tool for identifying and managing open-source components and their associated vulnerabilities, such as Snyk or Black Duck.
• Infrastructure as Code (IaC) Scanner: A tool for scanning your IaC templates (e.g., Terraform, CloudFormation) for security misconfigurations, such as Checkov or Terrascan.
• Policy Engine: A tool for defining and enforcing compliance policies, such as Open Policy Agent (OPA) or HashiCorp Sentinel.
• Compliance Reporting Tool: A tool for generating compliance reports and dashboards, such as Drata or Vanta.

The Role of Each Component

Each of these components plays a crucial role in ensuring that your applications and infrastructure are secure and compliant. The SCM provides a central repository for your code, while the CI/CD tool automates the build, test, and deployment process. SAST and DAST tools identify security vulnerabilities in your code and running applications, while SCA tools manage open-source components and their vulnerabilities. IaC scanners identify security misconfigurations in your infrastructure templates, and policy engines enforce compliance policies. Finally, compliance reporting tools provide visibility into the compliance status of your applications and infrastructure.

When I tested different SAST tools, I found that SonarQube provided a good balance between accuracy and ease of use. However, Checkmarx offered more advanced features for identifying complex vulnerabilities. Ultimately, the choice of SAST tool depends on your specific needs and budget. SonarQube's community edition is free and offers basic functionality, while Checkmarx is a commercial product with a higher price point. As of March 2026, Checkmarx pricing starts at around $15,000 per year for a small team.

Integrating the Components

The key to building a successful compliance-as-code pipeline is to seamlessly integrate these components into your CI/CD process. This means that each component should be automatically triggered as part of your pipeline, and the results should be used to determine whether the build or deployment should proceed. For example, if the SAST tool identifies a high-severity vulnerability, the pipeline should be automatically stopped, and the developer should be notified to fix the issue. Similarly, if the IaC scanner identifies a security misconfiguration, the deployment should be blocked until the issue is resolved.

Integrating Security and Compliance Checks

Integrating security and compliance checks into your CI/CD pipeline is essential for building secure and compliant applications. This involves embedding various security and compliance tools and processes into your pipeline, ensuring that every build and deployment is automatically evaluated against your defined standards.

Here are some common security and compliance checks that you can integrate into your pipeline:

• Static Code Analysis: Analyze source code for security vulnerabilities and coding standard violations.
• Dynamic Application Security Testing (DAST): Test running applications for security vulnerabilities.
• Software Composition Analysis (SCA): Identify and manage open-source components and their vulnerabilities.
• Infrastructure as Code (IaC) Scanning: Scan IaC templates for security misconfigurations.
• Container Image Scanning: Scan container images for vulnerabilities and malware.
• Compliance Policy Enforcement: Enforce compliance policies using a policy engine.
• Secret Scanning: Scan code and configuration files for exposed secrets, such as API keys and passwords.
• Vulnerability Scanning: Scan infrastructure and applications for known vulnerabilities.

Step-by-Step Example: Integrating SAST with GitLab CI

Here's a step-by-step example of how to integrate SAST with GitLab CI using SonarQube:

1. Install and Configure SonarQube: Download and install SonarQube on a server or use a cloud-based SonarQube instance. Configure SonarQube to connect to your GitLab repository.
2. Create a SonarQube Project: Create a new project in SonarQube for your application.
3. Configure GitLab CI: Add a `.gitlab-ci.yml` file to your repository with the following content:

stages:
  - test
  - sonarqube

sonarqube-check:
  image:
    name: sonarsource/sonar-scanner-cli:latest
    entrypoint: [""]
  stage: sonarqube
  variables:
    SONAR_USER_HOME: "/home/.sonar"  # Defines the location of the analysis task cache
    GIT_DEPTH: "0"  # Tells git to fetch all the branches of the project, required for accurate branch analysis
  cache:
    key: "${CI_JOB_NAME}"
    paths:
      - .sonar/cache
  script:
    - sonar-scanner -Dsonar.projectKey=$YOUR_SONARQUBE_PROJECT_KEY -Dsonar.sources=. -Dsonar.host.url=$YOUR_SONARQUBE_URL -Dsonar.login=$YOUR_SONARQUBE_TOKEN
  allow_failure: true
  only:
    - merge_requests
    - main

4. Replace Placeholders: Replace `$YOUR_SONARQUBE_PROJECT_KEY`, `$YOUR_SONARQUBE_URL`, and `$YOUR_SONARQUBE_TOKEN` with your SonarQube project key, URL, and token, respectively.
5. Commit and Push: Commit the `.gitlab-ci.yml` file to your repository and push it to GitLab.
6. Run the Pipeline: GitLab CI will automatically run the SonarQube analysis as part of your pipeline.
7. View Results: View the SonarQube analysis results in the SonarQube dashboard.

This example demonstrates how to integrate SAST with GitLab CI using SonarQube. You can adapt this example to integrate other security and compliance devops tools into your pipeline.

Comparing DevOps Tools for Compliance Automation

Choosing the right devops tools for compliance automation is crucial for building secure and compliant applications. There are many different tools available, each with its own strengths and weaknesses. Here's a comparison of some popular options:

This table provides a high-level comparison of some popular devops tools for compliance automation. The choice of tool depends on your specific needs and requirements. Consider factors such as the types of vulnerabilities you need to detect, the IaC frameworks you use, your budget, and your team's expertise when making your decision.

These tools are more focused on *demonstrating* compliance to auditors, rather than actively preventing issues in the CI/CD pipeline itself. They gather evidence and provide reports.

Policy as Code: Defining Your Compliance Rules

Policy as Code (PaC) is the practice of defining and managing compliance policies using code. This allows you to version control your policies, automate their enforcement, and treat them as first-class citizens in your software development lifecycle. PaC is a key enabler for automated compliance because it allows you to define your compliance rules in a machine-readable format that can be automatically enforced by your policy engine.

Tools like Open Policy Agent (OPA) and HashiCorp Sentinel allow you to define your policies using a declarative language such as Rego or Sentinel. These languages allow you to specify the conditions under which a policy should be enforced and the actions that should be taken when a policy is violated. For example, you can define a policy that requires all EC2 instances to be tagged with a specific tag or a policy that prohibits the use of certain ports in your firewall rules.

Benefits of Policy as Code

• Version Control: Policy definitions are stored in version control, allowing you to track changes, revert to previous versions, and collaborate with your team.
• Automation: Policies can be automatically enforced by your policy engine, ensuring consistent enforcement across your entire infrastructure.
• Repeatability: Policies can be easily replicated across different environments, ensuring consistency and reducing the risk of errors.
• Auditing: Policy definitions are auditable, providing a clear record of all changes made to your compliance rules.
• Centralized Management: Policies can be centrally managed and enforced, providing a single source of truth for your compliance rules.

Example: Using OPA to Enforce Tagging Policies

Here's an example of how to use OPA to enforce tagging policies on AWS EC2 instances:

1. Install OPA: Download and install OPA on a server or use a cloud-based OPA instance.
2. Define a Policy: Create a Rego file (e.g., `ec2-tagging.rego`) with the following content:

package aws.ec2

# Deny EC2 instances that are missing the 'owner' tag.
deny[msg] {
  input.resource.aws_ec2_instance
  not input.resource.aws_ec2_instance.tags.owner
  msg := "EC2 instance must have an 'owner' tag."
}

3. Load the Policy: Load the policy into OPA using the `opa run` command.
4. Evaluate the Policy: Evaluate the policy against your AWS EC2 instance data using the `opa eval` command.

opa eval -d ec2-tagging.rego -i ec2-instance.json 'data.aws.ec2.deny'

This example demonstrates how to use OPA to enforce a tagging policy on AWS EC2 instances. You can adapt this example to enforce other compliance policies on your infrastructure.

Pro Tip: Start with simple policies and gradually increase complexity as you gain experience with Policy as Code. Use a version control system to track changes to your policies and automate their deployment.

Infrastructure as Code (IaC) and Compliance

Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure using code, rather than manual configuration. This allows you to version control your infrastructure, automate its creation and management, and treat it as first-class citizens in your software development lifecycle. IaC is a critical enabler for automated compliance because it allows you to embed compliance checks directly into your infrastructure definitions.

Tools like Terraform, CloudFormation, and Azure Resource Manager allow you to define your infrastructure using a declarative language. This code defines the resources that you want to create, their properties, and their dependencies. By embedding compliance checks into your infrastructure definitions, you can ensure that your infrastructure is compliant with your defined standards.

Benefits of IaC for Compliance

• Version Control: Infrastructure definitions are stored in version control, allowing you to track changes, revert to previous versions, and collaborate with your team.
• Automation: Infrastructure can be automatically created and managed using IaC tools, reducing the risk of errors and ensuring consistency.
• Repeatability: Infrastructure can be easily replicated across different environments, ensuring consistency and reducing the risk of errors.
• Auditing: Infrastructure definitions are auditable, providing a clear record of all changes made to your infrastructure.
• Compliance Integration: Compliance checks can be seamlessly integrated into the infrastructure definition, ensuring that your infrastructure is compliant with your defined standards.

Example: Using Terraform to Enforce Security Group Rules

Here's an example of how to use Terraform to enforce security group rules:

resource "aws_security_group" "example" {
  name        = "example"
  description = "Example security group"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "example"
  }
}

This Terraform configuration defines a security group that allows SSH access from the `10.0.0.0/16` CIDR block and allows all outbound traffic. You can use IaC scanners like Checkov or Terrascan to scan this configuration for security misconfigurations. For example, Checkov can detect that the security group allows SSH access from a wide CIDR block, which is a potential security risk.

Container Security and Compliance

Containers have revolutionized software development and deployment, but they also introduce new security and compliance challenges. Container images can contain vulnerabilities, misconfigurations, and malware, which can compromise the security of your applications and infrastructure. It's crucial to implement container security and compliance checks in your DevOps pipeline to mitigate these risks.

Here are some common container security and compliance checks that you can integrate into your pipeline:

• Container Image Scanning: Scan container images for vulnerabilities and malware using tools like Clair, Trivy, or Anchore.
• Container Configuration Scanning: Scan container configurations for security misconfigurations using tools like Kube-bench or CIS Benchmarks.
• Runtime Security Monitoring: Monitor container runtime behavior for suspicious activity using tools like Falco or Sysdig.
• Image Provenance Verification: Verify the provenance of container images to ensure that they are built from trusted sources using tools like Notary or cosign.
• Compliance Policy Enforcement: Enforce compliance policies on container deployments using tools like Open Policy Agent (OPA) or Kyverno.

Example: Scanning Container Images with Trivy

Here's an example of how to scan container images with Trivy:

1. Install Trivy: Download and install Trivy on a server or use a cloud-based Trivy instance.
2. Scan a Container Image: Scan a container image using the `trivy image` command.

trivy image ubuntu:latest

Trivy will scan the `ubuntu:latest` container image for vulnerabilities and display the results. You can integrate this command into your CI/CD pipeline to automatically scan container images for vulnerabilities.

Pro Tip: Regularly update your container images to patch known vulnerabilities. Use a minimal base image to reduce the attack surface. Implement runtime security monitoring to detect and respond to suspicious activity.

Cloud Compliance Considerations

When deploying applications and infrastructure to the cloud, it's essential to consider cloud compliance requirements. Cloud providers like AWS, Azure, and Google Cloud have their own compliance certifications and standards, such as SOC 2, HIPAA, and GDPR. You need to ensure that your applications and infrastructure are compliant with these standards to meet your regulatory obligations.

Here are some key cloud compliance considerations:

• Data Residency: Ensure that your data is stored in a region that meets your data residency requirements.
• Data Encryption: Encrypt your data at rest and in transit to protect it from unauthorized access.
• Access Control: Implement strict access control policies to limit access to your data and resources.
• Logging and Monitoring: Enable logging and monitoring to track user activity and detect security incidents.
• Vulnerability Management: Regularly scan your cloud infrastructure for vulnerabilities and patch them promptly.
• Compliance Reporting: Generate compliance reports to demonstrate your compliance with relevant standards.

Cloud-Specific Compliance Tools

Cloud providers offer various tools and services to help you meet your compliance requirements. For example, AWS offers AWS Config, which allows you to assess, audit, and evaluate the configurations of your AWS resources. Azure offers Azure Policy, which allows you to enforce organizational standards and assess compliance at scale. Google Cloud offers Google Cloud Security Command Center, which provides a central view of your security and compliance posture.

When choosing a cloud provider, consider their compliance certifications and the tools and services they offer to help you meet your compliance requirements. Also, remember that compliance is a shared responsibility. The cloud provider is responsible for the security of the cloud, while you are responsible for the security of your applications and data in the cloud.

Real-World Example: Automating GDPR Compliance

Let's consider a hypothetical example of a company that needs to automate GDPR compliance in its DevOps pipeline. The company is a European e-commerce business that collects and processes personal data from its customers. To comply with GDPR, the company needs to ensure that its applications and infrastructure meet certain requirements, such as data minimization, data security, and data subject rights.

Here's how the company can automate GDPR compliance in its DevOps pipeline:

1. Define GDPR Compliance Policies: The company defines a set of GDPR compliance policies that specify the requirements for data minimization, data security, and data subject rights. These policies are codified using a policy engine like Open Policy Agent (OPA).
2. Integrate Security and Compliance Checks: The company integrates various security and compliance checks into its CI/CD pipeline, including SAST, DAST, SCA, IaC scanning, and container image scanning. These checks are configured to identify potential GDPR violations, such as storing personal data in cleartext or using insecure encryption algorithms.
3. Enforce Data Residency: The company ensures that all personal data is stored in a region that complies with GDPR data residency requirements. This is achieved by configuring its cloud infrastructure to only deploy resources to specific regions.
4. Implement Data Encryption: The company implements data encryption at rest and in transit to protect personal data from unauthorized access. This is achieved by using encryption services provided by its cloud provider and by enforcing the use of HTTPS for all communication.
5. Enable Logging and Monitoring: The company enables logging and monitoring to track user activity and detect security incidents that could potentially compromise personal data. This is achieved by using logging and monitoring services provided by its cloud provider and by configuring alerts to notify security personnel of suspicious activity.
6. Automate Data Subject Rights Requests: The company automates the processing of data subject rights requests, such as the right to access, the right to rectification, and the right to erasure. This is achieved by building APIs that allow customers to easily access, modify, or delete their personal data.

By automating GDPR compliance in its DevOps pipeline, the company can ensure that its applications and infrastructure are continuously compliant with GDPR requirements. This reduces the risk of fines and reputational damage and helps to build trust with its customers.

Best Practices for Compliance-as-Code

Here are some best practices for implementing a successful compliance-as-code strategy:

• Start Small: Don't try to automate everything at once. Start with a few key compliance checks and gradually expand your automation efforts.
• Use a Policy Engine: Use a policy engine like Open Policy Agent (OPA) or HashiCorp Sentinel to define and enforce your compliance policies.
• Integrate Security and Compliance Checks Early: Integrate security and compliance checks into your CI/CD pipeline as early as possible in the development lifecycle.
• Automate Everything: Automate as much of the compliance process as possible, including evidence collection, reporting, and remediation.
• Monitor Your Pipeline: Monitor your compliance-as-code pipeline to ensure that it is running smoothly and that compliance checks are being performed correctly.
• Document Your Processes: Document your compliance-as-code processes to ensure that everyone on your team understands how they work.
• Train Your Team: Train your team on the principles of compliance-as-code and the tools and technologies you are using.
• Regularly Review and Update Your Policies: Regularly review and update your compliance policies to ensure that they are up-to-date and effective.

Pro Tip: Treat your compliance policies as code and store them in version control. Use a peer review process to ensure that your policies are accurate and effective.

Troubleshooting Common Compliance Issues

Even with the best planning and implementation, you may encounter issues when automating compliance in your DevOps pipeline. Here are some common issues and how to troubleshoot them:

• False Positives: SAST and DAST tools can sometimes generate false positives, which can be frustrating and time-consuming to investigate. To reduce the number of false positives, configure your tools to use the most accurate rules and filters. Also, consider using a combination of different tools to get a more comprehensive view of your security posture.
• Performance Issues: Running security and compliance checks can sometimes slow down your CI/CD pipeline. To improve performance, optimize your tool configurations, use caching, and parallelize your checks.
• Integration Issues: Integrating different security and compliance tools into your CI/CD pipeline can sometimes be challenging. To avoid integration issues, use tools that are designed to work well together and follow the best practices for integration.
• Policy Conflicts: When using a policy engine, you may encounter policy conflicts, where different policies contradict each other. To resolve policy conflicts, carefully review your policies and adjust them to ensure that they are consistent and aligned.
• Lack of Visibility: It can be difficult to get a clear view of the compliance status of your applications and infrastructure. To improve visibility, use a compliance reporting tool that provides real-time dashboards and reports.

Frequently Asked Questions (FAQ)

Here are some frequently asked questions about automating compliance in DevOps:

Q: What is the difference between security and compliance?

Editorial Note: This article was researched and written by the AutomateAI Editorial Team. We independently evaluate all tools and services mentioned — we are not compensated by any provider. Pricing and features are verified at the time of publication but may change. Last updated: devops-pipeline-as-code-compliance.