audit-labs/control-coverage

 1# Gate a pipeline on framework coverage.
 2#
 3# Assumes an earlier job produced audit-report JSON packages under ./reports/
 4# (one per platform). This job fails the build if SOC 2 or ISO coverage drops
 5# below the threshold, and publishes the coverage report + Statement of
 6# Applicability as build artifacts.
 7name: control-coverage
 8
 9on:
10  workflow_dispatch:
11  schedule:
12    - cron: "0 6 * * 1" # Mondays, 06:00 UTC
13
14jobs:
15  coverage:
16    runs-on: ubuntu-latest
17    steps:
18      - uses: actions/checkout@v4
19
20      - uses: actions/setup-python@v5
21        with:
22          python-version: "3.12"
23
24      - name: Install control-coverage
25        run: pip install git+https://github.com/audit-labs/control-coverage
26
27      # Your own step(s) should populate ./reports/*.json with audit-report output.
28
29      - name: Coverage report + SoA
30        run: |
31          control-coverage ./reports/ \
32            --scope examples/soa.yaml \
33            --format md,html,json,soa \
34            --out coverage-out/
35
36      - name: Fail if coverage regresses
37        run: control-coverage ./reports/ --scope examples/soa.yaml --fail-under 60
38
39      - uses: actions/upload-artifact@v4
40        if: always()
41        with:
42          name: coverage
43          path: coverage-out/