Repository navigation
Adds a report over a period, and prebuilt binaries. sdlc-controls tier still assigns a risk tier to a change from its git diff and a declared component map, enforces that tier's controls in CI, and writes an evidence record for each run. Now sdlc-controls report reads a directory of those records back and writes one document an auditor or reviewer can read. It still needs no build tool and no network.
See what changed:
sdlc-controls report --evidence evidence/ --since 2026-07-01 --until 2026-09-30 --out report.md
sdlc-controls version
The report covers tiers and gate results, approvals, AI-assisted work, map drift, every exception with its reasons, and a standards view. It closes with a fixed statement of what it does not establish. Approvals keep verified and recorded, not verified in separate columns everywhere, and a record from 0.2.0 shows "not available" rather than a guess. Every file it does
not count is listed with the reason. The same records always produce the same bytes, and it is a report, not a gate: it exits 0 or 2, never 1. The worked example over the TraderX demo is examples/traderx/report.md, and docs/report.md says what each number means and does not mean. The standards view reads indicative ISO/IEC 27001:2022 and 42001:2023 mappings, embedded in the binary and written up row by row in docs/mappings/. They are indicative, not a certification or legal opinion. --mapping also takes a mapping file of your own, so an organisation's mapping never has to live in this repository.
Install: each release now carries a static binary for Linux, macOS and Windows on amd64 and arm64, built by GoReleaser from the tag, with a SHA-256 checksums.txt. Verify the archive before you run what is in it:
f=sdlc-controls_0.3.0_linux_amd64.tar.gz
grep " $f\$" checksums.txt | sha256sum -c - # macOS: shasum -a 256 -c -
or go install github.com/codeaiforge/git-native-sdlc-controls/cmd/sdlc-controls@v0.3.0.
Example jobs for GitLab CI, Jenkins and Azure DevOps are in docs/ci-adapters.md, and are not exercised in this repository's CI.
Not a purely additive upgrade: the binding moves to git-native-baseline@2 (ADR-0002). min_approvers is now met by approvers other than the author, at every tier. Under @1, a T3 change written by alice and approved by alice and bob met "2 approvers"; under @2 it has one. On GitHub and Gitea, which refuse self-approval, nothing changes in practice. A CI adapter
that passes the author in --approvers will see the gate fail where it passed before. binding_used tells the two apart. The text output changes in the binding line and the approver violation wording, and nowhere else.
The evidence record gains five additive fields: approvers_other_than_author, result.violated, author, head and self_escalated. A consumer no longer parses sentences to learn which control failed or which commit a record describes. evidence/0 stays at major 0, none of the new fields is required, and 0.2.0 records still validate. In a 0.2.0 record their absence means not recorded, never false. The component map gains a published schema, component-map/0, and provenance.generated_by, so a change to whatever generates a map self-escalates like a change to the map. The binary's only runtime dependency is still gopkg.in/yaml.v3.
Worth knowing before relying on it: the earlier limits are unchanged. Blast radius still comes from a hand-maintained map, not a computed dependency graph, so an undeclared high fan-in component is under-tiered. CAF-SDLC-011 still compares forge accounts, and it cannot tell who prompted the model. The report describes the records and nothing else. It cannot show that
branch protection or the named CI checks ran, and a change that never ran the gate is not in it. All of this is written up in docs/controls/ and docs/report.md.
Apache-2.0. Go 1.22+. Reference implementation, not a product.