v0.1.0

Assigns a risk tier to a change from its git diff and a declared component map, then enforces that tier's controls in CI: how many approvers, which checks, and an evidence record for each run. It needs no build tool and no network.

Run the demo:

make demo

It builds a throwaway TraderX-shaped repository and tiers four changes against examples/traderx/components.yaml, blocking two of them. Go and git are the only prerequisites.

Install:

go install github.com/codeaiforge/git-native-sdlc-controls/cmd/sdlc-controls@v0.1.0

On your own repository, copy config/components.example.yaml to config/components.yaml, describe your components in it, and tier a change:

sdlc-controls tier --base main --head HEAD --config config/components.yaml

Exit code 0 when the change meets its tier's controls, 1 when it does not, 2 on error. That
is the whole CI integration.

Worth knowing before relying on it: blast radius comes from a hand-maintained map, not a computed dependency graph, so an undeclared high fan-in component is under-tiered. CAF-SDLC-011 checks that two different forge accounts were involved — it cannot tell who prompted the model. Both limits are written up in docs/controls/.

The gate runs on this repository's own changes, on both Gitea and the GitHub mirror and the controls badge in the README is that history.

Apache-2.0. Go 1.22+. Reference implementation, not a product.