GitHub pull requests
What this tool proves, in the authored overlay. Every recipe below names GitHub pull requests; the controls are what their output is evidence for. The mapping is this project’s opinion (overlay v0.8.0) — the upstream FedRAMP rules name no vendor and no product.
Recipes calling GitHub pull requests (2)
- partialdeveloper-change-control-and-integrityweekly
The rules that made every change to the mainline arrive through a reviewed pull request, as a signed commit, onto a history that cannot be rewritten — together with the record of when those rules themselves last changed and who changed them, and the platform's own per-push record of any change that got past them.
- partialsecurity-representative-change-approvalcontinuous
The rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when.
Controls it carries evidence for (2)
The reverse of the join above. A mark here is the control’s own grade across the whole corpus, not its grade from this tool alone — a control this tool partly proves may be fully proved with another.
Tool names are canonical, from data/overlays/aws-services.json and data/overlays/pipeline-tools.json. The two overlays that name services spelled five of them two ways; a page keyed on the raw string would have split those in half.