Skip to content

Wire the Conformance Gate into CI

Goal: your pipeline refuses to release when the approved design has open drift, and checks Terraform plans against the design before applying them.

Needs

Large plan and above, an approved package, and an API key holding the compliance read scope. Store the key in your CI's secret store; the package ID is on the package header.

GitHub Actions

release-gate:
  runs-on: ubuntu-latest
  env:
    IA_API_URL: https://api.ironarchitects.com
  steps:
    - name: Conformance gate
      run: |
        curl -f -H "X-Api-Key: ${{ secrets.IA_API_KEY }}" -X POST \
          "$IA_API_URL/v1/analysis/conformance/packages/${{ vars.IA_PACKAGE_ID }}/gate?fail_status=true"

    - name: Terraform plan conformance
      run: |
        terraform show -json plan.out | curl -f -H "X-Api-Key: ${{ secrets.IA_API_KEY }}" \
          -H "Content-Type: application/json" --data-binary @- -X POST \
          "$IA_API_URL/v1/analysis/conformance/packages/${{ vars.IA_PACKAGE_ID }}/evaluate/terraform"

Azure Pipelines

- script: |
    curl -f -H "X-Api-Key: $(IA_API_KEY)" -X POST \
      "$(IA_API_URL)/v1/analysis/conformance/packages/$(IA_PACKAGE_ID)/gate?fail_status=true"
  displayName: Conformance gate

Tuning

  • ?min_severity=high blocks only on high and critical findings; start there.
  • ?refresh=true runs a fresh drift check instead of trusting the last scheduled one; worth the extra seconds on release builds.
  • Acknowledged findings never block; that is the governed override when a human has accepted a divergence.

Advisory First

Run the step without failing the build for a week (drop -f and fail_status). When the only hits are ones you would genuinely stop a release for, make it blocking. (The gate in full)