Advanced compliance framework features
The following advanced features help you implement the practices listed above more effectively. Note that these are typically enabled after you successfully apply the SHIP-HATS compliance framework.
For an overview of the compliance framework and available compliance levels, see SHIP-HATS compliance framework
Infrastructure as Code (IaC) scanning
From v1.0.3 onwards, IaC SAST scanning is enabled by default in the compliance framework.
✅ Default: IaC SAST scanning runs automatically.
⚙️ Optional: To disable, set IAC_SAST_DISABLED=true in your project’s CI/CD variables.
💡 Recommendation: Keep the default enabled if using GitOps to ensure pipeline security.
Resources
GitLab Native DAST API
From v1.0.4 onwards, GitLab native dast_api scans can be added to your pipeline.
✅ Default: Not enabled automatically. Apply latest SHIP-HATS Compliance template to include GitLab Native dast_api job in your pipeline.
⚙️ Optional: To disable, set DAST_API_DISABLED=true in your project’s CI/CD variables.
💡 Recommendation: Use this scan if your pipeline includes API testing; disabling it does not affect regular website DAST scans.
Resources
SLSA
From v1.0.3 onwards, the compliance framework integrates SLSA, SBOM, and attestation checks which are applied to E2E templates.
