ShipProof

ShipProof: Automated SOC 2 Compliance for GitLab CI

Comment 1

Inspiration

Every B2B software company I've seen eventually hits the same brick wall: an enterprise deal is ready to close, but infosec demands SOC 2 Type II change-management evidence.

Suddenly, senior engineers lose two weeks digging through Jira tickets, Slack channels, and Google Drive to grab screenshots proving that code was peer-reviewed, tested, and scanned for secrets. The whole process is manual, fragile, and honestly ridiculous. A screenshot carries zero cryptographic lineage and can be faked in ten seconds with inspect element.

I built ShipProof because I wanted compliance evidence to collect itself directly inside the deployment pipeline. When code merges, the proof should be generated, signed, and checked against a policy gate automatically. If something is missing, the release stops. If it passes, the auditor gets a single link with cryptographically verifiable proofs instead of a zip file full of PNGs.

What it does

ShipProof automates the entire SOC 2 change-management lifecycle inside GitLab CI:

  • Automatic proof capture on every commit: When code runs through the pipeline, ShipProof gathers test outputs from pytest, SAST results from Semgrep, secret scanning logs from Gitleaks, and a software bill of materials from Syft (CycloneDX). It packages these into a canonical JSON bundle alongside commit hashes, author metadata, and review approvals.
  • Deterministic release gate: I wrote an Open Policy Agent (OPA) engine in Rego that sits right before deployment. It evaluates the evidence bundle against strict controls. If a security scan is missing, if an artifact digest doesn't match, or if an approval looks like a rubber stamp (such as an approval granted in under five minutes on a 500-line diff, or an author approving their own code), the gate fails closed and blocks deployment.
  • Closed-loop gap triage: When a release is blocked, ShipProof doesn't just print an error. It automatically creates a tracked GitLab Work Item that specifies the exact failing control, links the commit, and explains what needs fixing. Once a subsequent commit resolves the issue, the pipeline closes the work item automatically.
  • Cryptographic ledger: Every bundle is signed (via Cosign or HMAC) and appended to a hash-chained JSONL ledger where each entry points to the previous block's SHA-256 digest.
  • Live auditor portal: Instead of sharing screenshots, I give auditors a link to a static React 19 app hosted on GitLab Pages. It runs client-side SHA-256 verification against the ledger, visually maps the OPA decision circuit, and provides one-click exports in JSON, CSV, and PDF.

How I built it

I built ShipProof solo, using Python 3.11 for the core engine, Rego for compliance policy, and React 19 for the auditor interface.

My core architectural rule was: LLMs explain, Rego decides.

Allowing an LLM to approve production releases or self-certify compliance is an operational nightmare. I used the GitLab Duo Agent Platform (.gitlab/duo/flows/) specifically for high-context human tasks: triaging scan failures, drafting Merge Request comments, and explaining why a gate failed. But the promotion authority itself remains 100% deterministic inside the OPA gate job.

I mapped and automated all nine stages of the GitLab DevSecOps lifecycle:

  1. Plan: Automated GitLab Work Items opened on gate denials and closed on passing fix commits.
  2. Create: CODEOWNERS protection on policy files, rubber-stamp approval checks (<5 min diffs), and Duo flow review notes.
  3. Verify: Native pytest, Semgrep SAST, and Gitleaks execution with artifact hashing.
  4. Package: Syft CycloneDX SBOM generation with artifact digest attestation.
  5. Secure: Deterministic OPA Rego policy evaluation against signatures, hashes, and approvals.
  6. Release: Blocking compliance gate job that prevents CD execution unless policy passes.
  7. Configure: Dynamic Google Cloud Run deployment manifests rendered at deploy time without hardcoded secrets.
  8. Monitor: Post-deploy SHA-drift checks verifying that the running container image tag matches the bundle-approved commit.
  9. Govern: Immutable hash-chained ledger driving the auditor dashboard and signed PDF/CSV exports.

Challenges I ran into

  • Building a zero-hallucination compliance gate: It was tempting to let an LLM parse diffs and decide if code was safe, but compliance requires auditability. Writing the OPA policy in Rego forced me to define mathematical conditions for human intent, like flagging approvals that happen too fast on large diffs.
  • Managing cryptographic trust in ephemeral runners: GitLab CI jobs run in isolated containers. I had to pass HMAC and Cosign verification data between attest, gate, and deploy stages using dotenv artifacts while strictly ensuring that signing keys were stripped before the deployment environment to prevent key leakage.
  • Running a full auditor experience on static hosting: I wanted the auditor dashboard to live on GitLab Pages without requiring a paid backend container. I built the interface in React 19 with hash routing, bundled pre-compiled JSON endpoints, and wrote client-side Web Crypto SHA-256 verification so an auditor can verify ledger integrity right in their browser.

Accomplishments that I'm proud of

  • Automated all 9 stages of the GitLab DevSecOps lifecycle as an individual developer.
  • Wrote 93 automated unit and contract tests covering the collector, gate logic, ledger chaining, and API endpoints.
  • Got the OPA release gate evaluating in under 18 milliseconds in CI.
  • Proved the concept live with two permanent GitLab pipelines: one passing pipeline (demo/good) that promotes to production, and one negative test (demo/missing-scan) that proves the gate actively blocks bad releases and opens a tracked work item.

What I learned

  • In regulated enterprise environments, the most valuable AI architecture is one where agents summarize and assist, but deterministic code retains the final gate.
  • Auditors don't want AI-generated summaries; they want reproducible hashes, clear control mappings, and immutable timelines.
  • Working deeply with the GitLab Duo Agent Platform, Rego policy structures, and CycloneDX SBOM specifications gave me a much clearer view of how modern continuous compliance will look.

What's next for ShipProof

  • Adding ISO 27001 (Annex A.8.32) and HIPAA (§ 164.312) policy templates alongside the current SOC 2 CC8.1/CC7.2 rules.
  • Integrating Sigstore Fulcio and Rekor for keyless OIDC signing directly through GitLab SaaS runners.
  • Building automated MR creation so Duo agents can draft the actual code fix for routine dependency and secret scan failures.

Built With

  • cosign
  • cyclonedx
  • docker
  • fastapi
  • gitlab-ci/cd
  • gitlab-duo
  • gitleaks
  • google-cloud-run
  • open-policy-agent
  • python
  • react-19
  • rego
  • semgrep
  • syft
  • tailwind-css
  • typescript
Share this project:

Updates

Submission history