Compliance report

Version history

Compliance report gives you the ability to see a group’s merge request activity. It provides a high-level view for all projects in the group. For example, code approved for merging into production.

To access compliance report for a group, go to Security & Compliance > Compliance on the group’s menu.

noteCompliance report shows only the latest merge request on each project.

Merge request drawer

Introduced in GitLab 14.1.

When you click on a row, a drawer is shown that provides further details about the merge request:

  • Project name and compliance framework label, if the project has one assigned.
  • Link to the merge request.
  • The merge request’s branch path in the format [source] into [target].
  • A list of users that committed changes to the merge request.
  • A list of users that commented on the merge request.
  • A list of users that approved the merge request.
  • The user that merged the merge request.

Use cases

This feature is for people who care about the compliance status of projects within their group.

You can use the report to:

  • Get an overview of the latest merge request for each project.
  • See if merge requests were approved and by whom.
  • See merge request authors.
  • See the latest CI Pipeline result for each merge request.


Approval status and separation of duties

We support a separation of duties policy between users who create and approve merge requests. The approval status column can help you identify violations of this policy. Our criteria for the separation of duties is as follows:

The Approval status column shows you at a glance whether a merge request is complying with the above. This column has four states:

State Description
Empty The merge request approval status is unknown
Failed The merge request does not comply with any of the above criteria
Warning The merge request complies with some of the above criteria
Success The merge request complies with all of the above criteria

If you see a non-success state, review the criteria for the merge request’s project to ensure it complies with the separation of duties.

Chain of Custody report

The Chain of Custody report allows customers to export a list of merge commits within the group. The data provides a comprehensive view with respect to merge commits. It includes the merge commit SHA, merge request author, merge request ID, merge user, pipeline ID, group name, project name, and merge request approvers. Depending on the merge strategy, the merge commit SHA can be a merge commit, squash commit, or a diff head commit.

To download the Chain of Custody report, navigate to Security & Compliance > Compliance on the group’s menu and click List of all merge commits

Commit-specific Chain of Custody Report

You can generate a commit-specific Chain of Custody report for a given commit SHA. To do so, select the dropdown next to the List of all merge commits button at the top of the compliance report.

noteThe Chain of Custody report download is a CSV file, with a maximum size of 15 MB. The remaining records are truncated when this limit is reached.