gitlab-compliance 2.0.0__py3-none-any.whl

gitlab_compliance-2.0.0.dist-info/METADATA

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: gitlab-compliance
+Version: 2.0.0
+Summary: Gitlab automatically generates gitlab documentation from yaml files
+License-File: LICENSE
+Author: Charlie Smith
+Author-email: me@charlieasmith.co.uk
+Requires-Python: >=3.12,<3.13
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Requires-Dist: behave (>=1.2.6,<2.0.0)
+Requires-Dist: click (>=8.1.8,<9.0.0)
+Requires-Dist: idna (==3.15)
+Requires-Dist: jq (==1.8.0)
+Requires-Dist: loguru (==0.7.0)
+Requires-Dist: markdown-analysis (==0.1.5)
+Requires-Dist: oras (==0.2.42)
+Requires-Dist: oyaml
+Requires-Dist: prettytable
+Requires-Dist: pytablewriter (==1.2.0)
+Requires-Dist: python-gitlab (==7.0.0)
+Requires-Dist: pyyaml (==6.0.2)
+Requires-Dist: requests (==2.34.2)
+Requires-Dist: rich (==14.2.0)
+Requires-Dist: semver (==3.0.2)
+Requires-Dist: typer (==0.10.0)
+Requires-Dist: urllib3 (==2.7.0)
+Project-URL: Documentation, https://maturitybuilder.github.io/gitlab-compliance/
+Project-URL: Home Page, https://maturitybuilder.github.io/gitlab-compliance/
+Project-URL: Repository, https://github.com/MaturityBuilder/gitlab-compliance
+Description-Content-Type: text/markdown
+
+# gitlab-compliance
+
+`gitlab-compliance` (PyPI package [`gitlab-compliance`](https://pypi.org/project/gitlab-compliance/)) is a lightweight, security and compliance focused test framework for GitLab CI/CD. It runs Gherkin policies against `.gitlab-ci.yml` and optional GitLab API settings — the same BDD model as [terraform-compliance](https://terraform-compliance.com/) uses for Terraform plans.
+
+Source code: [MaturityBuilder/gitlab-compliance](https://github.com/MaturityBuilder/gitlab-compliance).
+
+- **compliance:** Ensure pipeline YAML and project settings follow your security standards and custom policies
+- **behaviour driven development:** Policies are readable Gherkin scenarios that developers and security teams share
+- **portable:** Install from `pip`. See [Installation](installation/index.md)
+- **pre-merge:** Validate configuration before changes land on protected branches
+- **YAML and API:** Offline checks against pipeline files; optional GitLab API checks for project settings and CI variables
+- **easy to integrate:** Run in GitLab CI or local git hooks
+- **segregation of duty:** Keep policy packs in a separate repository or OCI registry
+- **documentation:** Generate Markdown or HTML reference docs from `.gitlab-ci.yml`
+
+## Idea
+
+`gitlab-compliance` focuses on [negative testing](https://en.wikipedia.org/wiki/Negative_testing) — catching misconfigurations and policy violations — rather than proving that a job runs successfully end to end.
+
+GitLab CI pipelines are defined in YAML that composes jobs, includes, variables, and workflow rules. What was missing is a lightweight way to assert that this configuration follows organizational standards before merge. GitLab offers native compliance features in higher tiers; `gitlab-compliance` provides an open, portable alternative inspired by [terraform-compliance](https://terraform-compliance.com/) and [Conftest](https://www.conftest.dev/).
+
+For example, a policy might require that no job uses a floating `latest` image tag:
+
+```
+if a job defines an image, it must not use the :latest tag
+```
+
+translates into:
+
+```gherkin
+Given I have any job defined
+When it has image
+Then its image must not match ":latest$"
+```
+
+The `image` value comes from your pipeline YAML:
+
+```yaml
+scan:
+  image: python:3.12
+build:
+  image: docker:latest   # violates the policy above
+```
+
+In CI, this scenario runs against `.gitlab-ci.yml` (and resolved local includes) so merge requests cannot introduce violations.
+
+See [Examples](examples/index.md) for more sample use cases.
+
+## Supporting / Requirements
+
+- **Python:** 3.12 (see [Installing via pip](installation/pip.md))
+- **Pipeline file:** `.gitlab-ci.yml` or another path passed with `-p`
+- **API checks (optional):** GitLab token plus `--project` or `--group` for settings and CI variable policies
+
+Full CLI options: [Usage](usage/index.md). Step grammar: [BDD Reference](bdd-reference/index.md).
+
+## How can you support the project?
+
+Contributions are welcome — see [Contributing](contributing.md).
+

gitlab_compliance-2.0.0.dist-info/RECORD

@@ -0,0 +1,50 @@
+src/__init__.py,sha256=mqMuQB3aqJVPrHHqJMLjqiMKUiJjozc7EPLcX5DpKHg,22
+src/compliance/__init__.py,sha256=ZtqcTSIFqri7ZTe5GJyUzR3mZZI3BoxXqcAlEHITz3o,52
+src/compliance/api_config.py,sha256=ZEc-kh1Apcwv_3nvP4oUF4-bggcMtgwi_GCZDTeIAJs,3010
+src/compliance/api_enrichment.py,sha256=HEr8K702WQ4y28vK_Ve1q7ZROh1S8cC7jo48bjUcYIY,1424
+src/compliance/behave_support/environment.py,sha256=sIXVQ6u9np1Znr85BCUGQ4n6oOMsS7mRfVAPkTwC3A8,1531
+src/compliance/behave_support/steps/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/compliance/behave_support/steps/given_steps.py,sha256=sel8u3UD0D3v6YLDV1z-VPMXygQs1HZbWlHiN0EgiZY,4838
+src/compliance/behave_support/steps/then_steps.py,sha256=TESTwgzEV3YXojyjEBzSKhsGl47agW8dkcvLJnzgzaQ,6951
+src/compliance/behave_support/steps/when_steps.py,sha256=Pasdn2wb7I-9bxuapWdk_v37EFqQY3brfstazIwWxvQ,5234
+src/compliance/console.py,sha256=oy5mjUGWr47u3zZ3J8zk8gnV0_cZX--Ht0leu6baaEQ,3311
+src/compliance/container_fix.py,sha256=Pw14gpEwE2q0AkZkUcBxbG6ACP7VO2YZFaZz5_dd9Hw,4576
+src/compliance/gitlab_api.py,sha256=_vt9r39Um_tUsVu_UviKPXv8EbZ3_WzgQyghnLMMlCw,2717
+src/compliance/image_versions.py,sha256=t6VJ1r5HO9D1Qas4XgMsasyzZOa8SuDreQyfRTWVk8I,10193
+src/compliance/include_fix.py,sha256=kRrYbu1p02_DsSrZMcF6g14n-qNIganRljzTkMjNuSA,3665
+src/compliance/include_versions.py,sha256=Ju6XvvU4dk8YW0XKyJ96_o41NnZUYfsHVIBcjb0ABFY,7751
+src/compliance/metadata.py,sha256=tWQoDoauUob2NDxyRn2WaI6aWPzeBrMtETDsBdV-pbc,7217
+src/compliance/model.py,sha256=6sWbYpBnzJnjo1PR72VYfQW4VpRk_7Bbh_0mXpISdxk,9655
+src/compliance/models.py,sha256=Rfm-aKCqLad9QySyar9xrXwICA0e1EZewkm7aACDIzs,560
+src/compliance/oci_registry.py,sha256=s-IXIGpLRH9_90W73liyoBZnKk51C9F_iTNiIKM1-T0,4890
+src/compliance/policy_doc.py,sha256=mYv08eC2KmXGLpIWWEn3PfL7qKyNaa_ltHTdPjIanMM,6328
+src/compliance/release_cache.py,sha256=LQxCioYRgrGBXMfzWUfnk6Rc65qG1goMK1oqMjW4qYc,1903
+src/compliance/render.py,sha256=fC68PZe2gmpQySMxeocaY7JeMW1SsOqs9vOeIq6BCU4,12537
+src/compliance/runner.py,sha256=erDcZhQfDGRiiuAsSYDdc7w_Os9wFZo-hwr5U68apUQ,10791
+src/compliance/stash.py,sha256=Nb15Wwjt6AsOoazKxYYGAQgD2VqFns4vjqZYCxPa9EA,6311
+src/compliance/supply_chain_fix.py,sha256=1yHdsEyFTxBR108V63S40O6mLpstqgs1p203YQcMEPc,2046
+src/gitlab_compliance.py,sha256=iLwi4kHmbXSRCB0HA5dPhs7JXSaSW6wI6oUx52LhSw8,17549
+src/gitlab_docs.py,sha256=3OZ7w29IP72HtZxDxgEpBu6B_ER7B5bjmqy5sMaAfQY,994
+src/modules/__init__.py,sha256=oSKhQHo_8dYEVv3A19nCmQysoh4TbOzHl508xX9iHoo,23
+src/modules/command_reference.py,sha256=IwV733I67WnoUGGQsklhPeAXPEA_oJK3vJ3n_RurGP0,6452
+src/modules/common.py,sha256=LAXF15up9zOOa3kiKlPIfB_OqAPryg6wdhuTQPQXIeA,3706
+src/modules/constants.py,sha256=Td-hzTzUYuSvSRMvgqUojIZPgTiWSZ2V7UbyCG9qZ5c,617
+src/modules/doc_controller.py,sha256=hhkPbvKKyLKmxjsL3tXWHc9fOWdrCozdC-z303i5HNM,6281
+src/modules/logging.py,sha256=lKLi2r1Ma29bnFGc7VEw_VGVPnB5i2zCoJiKVC0VDOU,932
+src/modules/pipeline_data.py,sha256=ysLFIZXeEt2V5Y1PcyXFN3lWmqtuIuaN1DFKOTJkGzM,12308
+src/modules/release.py,sha256=7Gdms_KU4HhweXFAAS9x9-UjB-wauXDlMBiKFVgJj8s,10681
+src/modules/swagger_html.py,sha256=BwKemuQ12T8UGVokRNQQhZQVGHlicEkfOuyiAH5DuDc,12195
+src/modules/yaml_lines.py,sha256=FsQFKiusi_dDZO6ZLSzfOvvPg7c1SBFQmw433k5GCV4,2402
+src/modules/yaml_md_table.py,sha256=jcBBJupTQkD6ZXvTk_uiI3TS3zXFlTvKBPbeTW2jI8k,1155
+src/properties/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/properties/extract_job_attribute.py,sha256=ZydTsP_ENE5n-U7hQEdUGJQtwa38cXBoHZuudYsEILI,2172
+src/properties/includes.py,sha256=gvRrJONvUN-AuKNyd-ZLemDxi_SGA1eRy-rJWOVeeQo,7188
+src/properties/inputs.py,sha256=csRcl62eXDD2BVYSUoxBL0QcJMCo5ptSXnaNsKY6ATg,3513
+src/properties/jobs.py,sha256=w_jfGkXobQ_DzZoHwbjsDPmv1mzyhDAcY440aJW6QKs,7870
+src/properties/variables.py,sha256=7GZThGowq3aHIotrnRNfna47pNvxK4ZhMsaKD6pSK2A,3911
+src/properties/workflows.py,sha256=Qv_iXag5RXsFjFoBVAX7tEohhB1v4fAuAazSWxlE4MU,2089
+gitlab_compliance-2.0.0.dist-info/METADATA,sha256=Se9O7G5ZjGMQbqCQwbsw6gKIjzHt1KkLsULI_ZQyxWs,4211
+gitlab_compliance-2.0.0.dist-info/WHEEL,sha256=EGEvSphFYqXKs23-kQBeyNoJP1nrT8ZJKQoi5p5DYL8,88
+gitlab_compliance-2.0.0.dist-info/entry_points.txt,sha256=_ZeapNtwblG_VkP-YrYRzFzK51Gq-mauZGf9P5HBAiI,129
+gitlab_compliance-2.0.0.dist-info/licenses/LICENSE,sha256=Vs5PryRiGYf-ga-K4faB-K2Xn2cUr0z6UMUEkA7oOW4,1103
+gitlab_compliance-2.0.0.dist-info/RECORD,,

gitlab_compliance-2.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.4.0
+Root-Is-Purelib: true
+Tag: py3-none-any

gitlab_compliance-2.0.0.dist-info/entry_points.txt

@@ -0,0 +1,4 @@
+[console_scripts]
+gitlab-compliance=src.gitlab_compliance:gitlab_compliance
+gitlab-docs=src.gitlab_compliance:gitlab_compliance
+

gitlab_compliance-2.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) [2024] [Charles Smith] [DevOps Contracting Limited]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.0.6"

src/compliance/__init__.py

@@ -0,0 +1 @@
+"""GitLab CI/CD configuration compliance engine."""

src/compliance/api_config.py

@@ -0,0 +1,94 @@
+"""Resolve GitLab API connection settings for compliance checks."""
+
+from __future__ import annotations
+
+import os
+from typing import Any, Literal
+
+ApiScope = Literal["project", "group"]
+
+
+def _userdata_value(userdata: dict[str, Any], key: str) -> str | None:
+    value = userdata.get(key)
+    if value:
+        return str(value)
+    return None
+
+
+def resolve_token(userdata: dict[str, Any] | None = None) -> str | None:
+    # Tokens must not be passed through Behave userdata (may appear in logs/reports).
+    return os.getenv("GITLAB_TOKEN") or os.getenv("CI_JOB_TOKEN")
+
+
+def resolve_project(userdata: dict[str, Any] | None = None) -> str | None:
+    userdata = userdata or {}
+    return _userdata_value(userdata, "project") or os.getenv("CI_PROJECT_PATH")
+
+
+def resolve_group(userdata: dict[str, Any] | None = None) -> str | None:
+    userdata = userdata or {}
+    return _userdata_value(userdata, "group") or os.getenv("GITLAB_GROUP_PATH")
+
+
+def project_api_ready(userdata: dict[str, Any] | None = None) -> bool:
+    return bool(resolve_token(userdata) and resolve_project(userdata))
+
+
+def group_api_ready(userdata: dict[str, Any] | None = None) -> bool:
+    return bool(resolve_token(userdata) and resolve_group(userdata))
+
+
+def gitlab_api_ready(userdata: dict[str, Any] | None = None) -> bool:
+    return bool(resolve_token(userdata))
+
+
+def _missing_connection_message(scope: ApiScope, label: str) -> str:
+    if scope == "project":
+        return (
+            f"GitLab API connection info not provided for {label}. "
+            "Set --token and --project (or GITLAB_TOKEN/CI_JOB_TOKEN and CI_PROJECT_PATH)."
+        )
+    return (
+        f"GitLab API connection info not provided for {label}. "
+        "Set --token and --group (or GITLAB_TOKEN/CI_JOB_TOKEN)."
+    )
+
+
+def _missing_gitlab_api_message(label: str) -> str:
+    return (
+        f"GitLab API token not provided for {label}. "
+        "Set --token or GITLAB_TOKEN/CI_JOB_TOKEN."
+    )
+
+
+def require_gitlab_api(context, label: str) -> bool:
+    userdata = context.config.userdata
+    if gitlab_api_ready(userdata):
+        return True
+
+    message = _missing_gitlab_api_message(label)
+    if userdata.get("strict") == "true":
+        raise AssertionError(message)
+
+    from src.compliance.behave_support.environment import _skip_remaining_steps
+
+    _skip_remaining_steps(context, message)
+    return False
+
+
+def require_api_connection(context, scope: ApiScope, label: str) -> bool:
+    userdata = context.config.userdata
+    ready = (
+        project_api_ready(userdata) if scope == "project" else group_api_ready(userdata)
+    )
+    if ready:
+        return True
+
+    message = _missing_connection_message(scope, label)
+    if userdata.get("strict") == "true":
+        raise AssertionError(message)
+
+    from src.compliance.behave_support.environment import _skip_remaining_steps
+
+    _skip_remaining_steps(context, message)
+    return False

src/compliance/api_enrichment.py

@@ -0,0 +1,52 @@
+"""Detect which API-backed enrichment steps a policy pack requires."""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+
+
+@dataclass
+class ApiEnrichmentRequirements:
+    enrich_includes: bool = False
+    enrich_images: bool = False
+    load_api_entities: bool = False
+
+
+INCLUDE_MARKERS = (
+    "include with release metadata",
+    "newer release",
+    "within the latest",
+)
+
+IMAGE_MARKERS = (
+    "container image with release metadata",
+    "registry latest",
+)
+
+API_ENTITY_MARKERS = (
+    "project setting",
+    "project ci variable",
+    "group setting",
+)
+
+
+def policies_require_api_enrichment(features_dir: str) -> ApiEnrichmentRequirements:
+    reqs = ApiEnrichmentRequirements()
+    if not os.path.isdir(features_dir):
+        return reqs
+
+    combined: list[str] = []
+    for root, _dirs, files in os.walk(features_dir):
+        for filename in files:
+            if not filename.endswith(".feature"):
+                continue
+            feature_path = os.path.join(root, filename)
+            with open(feature_path, encoding="utf-8") as handle:
+                combined.append(handle.read().lower())
+
+    text = "\n".join(combined)
+    reqs.enrich_includes = any(marker in text for marker in INCLUDE_MARKERS)
+    reqs.enrich_images = any(marker in text for marker in IMAGE_MARKERS)
+    reqs.load_api_entities = any(marker in text for marker in API_ENTITY_MARKERS)
+    return reqs

src/compliance/behave_support/environment.py

@@ -0,0 +1,43 @@
+"""Behave environment for GitLab compliance policies."""
+
+from __future__ import annotations
+
+from src.compliance.model import load_pipeline_entities
+
+
+def before_all(context):
+    context.compliance_entities = {}
+    context.stash = []
+    context.step_mode = None
+    context.scenario_skipped = False
+
+
+def before_scenario(context, scenario):
+    context.stash = []
+    context.step_mode = None
+    context.scenario_skipped = False
+
+    pipeline = context.config.userdata.get("pipeline")
+    if not pipeline:
+        raise RuntimeError("Pipeline file not configured for compliance run.")
+
+    if not context.compliance_entities:
+        context.compliance_entities = load_pipeline_entities(
+            pipeline_file=pipeline,
+            include_nested=context.config.userdata.get("include_nested", "true")
+            == "true",
+            gitlab_url=context.config.userdata.get("gitlab_url") or None,
+            project=context.config.userdata.get("project") or None,
+            group=context.config.userdata.get("group") or None,
+            enrich_includes=context.config.userdata.get("enrich_includes", "true")
+            == "true",
+            enrich_images=context.config.userdata.get("enrich_images", "true")
+            == "true",
+            load_api_entities=context.config.userdata.get("load_api_entities", "true")
+            == "true",
+        )
+
+
+def _skip_remaining_steps(context, reason: str):
+    context.scenario_skipped = True
+    context.scenario.skip(reason)

src/compliance/behave_support/steps/given_steps.py

@@ -0,0 +1,154 @@
+"""GIVEN steps for GitLab compliance policies."""
+
+from __future__ import annotations
+
+from behave import given
+
+from src.compliance.api_config import require_api_connection, require_gitlab_api
+from src.compliance.behave_support.environment import _skip_remaining_steps
+from src.compliance.stash import (
+    container_image_release_metadata_resolved,
+    filter_entities,
+    include_release_metadata_resolved,
+)
+
+
+def _set_stash(context, entities: list[dict]):
+    context.stash = list(entities)
+    context.step_mode = "given"
+    context.scenario_skipped = False
+
+
+def _set_stash_or_skip(context, entities: list[dict], *, skip_reason: str):
+    if not entities:
+        _skip_remaining_steps(context, skip_reason)
+        return
+    _set_stash(context, entities)
+
+
+@given("I have any job defined")
+def given_any_job(context):
+    _set_stash(context, context.compliance_entities.get("jobs", []))
+
+
+@given('I have job "{name}" defined')
+def given_named_job(context, name):
+    jobs = [
+        job
+        for job in context.compliance_entities.get("jobs", [])
+        if job.get("name") == name
+    ]
+    _set_stash_or_skip(
+        context, jobs, skip_reason=f'No job named "{name}" found in pipeline'
+    )
+
+
+@given("I have any include defined")
+def given_any_include(context):
+    _set_stash(context, context.compliance_entities.get("includes", []))
+
+
+@given('I have include type "{include_type}" defined')
+def given_include_type(context, include_type):
+    includes = filter_entities(
+        context.compliance_entities.get("includes", []),
+        lambda entity: entity.get("include_type") == include_type,
+    )
+    _set_stash_or_skip(
+        context,
+        includes,
+        skip_reason=f'No includes of type "{include_type}" found in pipeline',
+    )
+
+
+@given("I have any include with release metadata defined")
+def given_any_include_with_release_metadata(context):
+    if not require_gitlab_api(context, "include release checks"):
+        return
+    includes = filter_entities(
+        context.compliance_entities.get("includes", []),
+        include_release_metadata_resolved,
+    )
+    _set_stash_or_skip(
+        context,
+        includes,
+        skip_reason="No includes with release metadata resolved",
+    )
+
+
+@given("I have any container image defined")
+def given_any_container_image(context):
+    _set_stash(context, context.compliance_entities.get("container_images", []))
+
+
+@given('I have container image from "{image_source}" defined')
+def given_container_image_from_source(context, image_source):
+    images = filter_entities(
+        context.compliance_entities.get("container_images", []),
+        lambda entity: entity.get("image_source") == image_source,
+    )
+    _set_stash_or_skip(
+        context,
+        images,
+        skip_reason=f'No container images from "{image_source}" found in pipeline',
+    )
+
+
+@given("I have any container image with release metadata defined")
+def given_any_container_image_with_release_metadata(context):
+    images = filter_entities(
+        context.compliance_entities.get("container_images", []),
+        container_image_release_metadata_resolved,
+    )
+    _set_stash_or_skip(
+        context,
+        images,
+        skip_reason="No container images with release metadata resolved",
+    )
+
+
+@given("I have any variable defined")
+def given_any_variable(context):
+    _set_stash(context, context.compliance_entities.get("variables", []))
+
+
+@given("I have any workflow rule defined")
+def given_any_workflow_rule(context):
+    _set_stash(context, context.compliance_entities.get("workflow_rules", []))
+
+
+@given("I have any project setting defined")
+def given_any_project_setting(context):
+    if not require_api_connection(context, "project", "project setting checks"):
+        return
+    _set_stash(context, context.compliance_entities.get("project_settings", []))
+
+
+@given('I have project setting "{name}" defined')
+def given_project_setting(context, name):
+    if not require_api_connection(context, "project", "project setting checks"):
+        return
+    settings = [
+        setting
+        for setting in context.compliance_entities.get("project_settings", [])
+        if setting.get("name") == name
+    ]
+    _set_stash_or_skip(
+        context,
+        settings,
+        skip_reason=f'No project setting "{name}" found',
+    )
+
+
+@given("I have any project ci variable defined")
+def given_any_project_ci_variable(context):
+    if not require_api_connection(context, "project", "project CI variable checks"):
+        return
+    _set_stash(context, context.compliance_entities.get("project_ci_variables", []))
+
+
+@given("I have any group setting defined")
+def given_any_group_setting(context):
+    if not require_api_connection(context, "group", "group setting checks"):
+        return
+    _set_stash(context, context.compliance_entities.get("group_settings", []))