Hardening the Source: Scaling Branch Governance with Gemara, ComplyTime and Ampel
summary
Demo shows an automated governance pipeline that turns branch protection into verifiable evidence: it uses Gemara + ComplyTime + Ampel to define policy as code, generate provider-specific checks, snapshot GitHub branch-protection via API, emit signed attestations and store results as OCI artifacts. A reusable GitHub workflow runs daily, producing Jamara-format evaluation logs and a “red-to-green” live transition during the demo, proving the system scales across many repos and actually enforces continuous verifiable checks.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:46Branch governance core problem
- 4:13Goals for compliance automation
- 7:05Introducing Jamara
- 9:12Jamara’s layered model
- 12:46High-level to product-specific rules
- 14:56Complyctl overview
- 16:00Ampel for branch protection
- 19:55Granular compliance policies
- 21:00Complyctl design
- 23:07Jamara to provider outputs
- 24:33Reusable workflows with or-infra
- 27:01Two-step compliance setup
- 29:50Implementation resources
- 30:36Q&A
related talks
17mNo More Walled Gardens: Removing Barriers with SCM...
40mA Guide to Securing GitHub Based on Lessons Learned
39mA Guide to Securing GitHub Based on Lessons Learned
49mProtect Your Code with GitHub Security Features
30mAutomating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps
43mGitHub Actions Best Practices
46mEnhancing Artifact Security with GitHub’s Build Provenance...
36mKeynote - Automated Governance