How-to guide Policy, CI, and compliance

Generate an audit bundle

Write scorecard, SBOM, provenance, OSCAL, and Markdown evidence in one directory.

Use kix compliance audit when a review or compliance process needs the cluster’s policy findings and build evidence together. The command evaluates the cluster locally and writes five files.

Write the bundle

Choose an output directory and, in CI, supply the workflow URL as the builder ID:

kix-examples/

❱ kix compliance audit 19-scorecards --out ./compliance --builder-id https://ci.example/runs/1842
Building cluster '19-scorecards'...
  Evaluating cluster '19-scorecards'...
  copying path '/nix/store/4rg99msfmkk9gppakagpgkzcixwg7yxq-source' from 'https://cache.nixos.org'...
  Building '19-scorecards'...
  copying path '/nix/store/kppfbp4x7mhfz1q5zswavxxxq71v2f7c-gnu-config-2024-01-01' from 'https://cache.nixos.org'...
  copying path '/nix/store/xx0z77494lfxr8qjwpck246fry05n3nm-xgcc-15.2.0-libgcc' from 'https://cache.nixos.org'...
  copying path '/nix/store/wrxyd3k2f4bmh52pr5rpdjxxsm5r2qxm-gcc-15.2.0-libgcc' from 'https://cache.nixos.org'...
  copying path '/nix/store/i4gg1f526vl5psg5nqniflj4v77vc1kd-libunistring-1.4.2' from 'https://cache.nixos.org'...
  copying path '/nix/store/9vv51km72lpngs6aixxplrr3c88q4c3c-update-autotools-gnu-config-scripts-hook' from 'https://cache.nixos.org'...
  copying path '/nix/store/sgswwrxkhdlfskklqp4gsbi2cskfg07c-libidn2-2.3.8' from 'https://cache.nixos.org'...
  copying path '/nix/store/fjkx1l5cnskzrqacf08z7i8z17256w0j-glibc-2.42-61' from 'https://cache.nixos.org'...
  copying path '/nix/store/i27rhb3nr65rkrwz36bchkwmav6ggsmn-bash-5.3p9' from 'https://cache.nixos.org'...
  copying path '/nix/store/sl325r3s6d4gl9lmr2hwg2wgp2m0qs7c-attr-2.5.2' from 'https://cache.nixos.org'...
  copying path '/nix/store/2amncb4zvr32gm5d2i8m6gz29c02cn61-bzip2-1.0.8' from 'https://cache.nixos.org'...
  copying path '/nix/store/jw7ki3s7krg2ddq00hb8563bd1i4ddrg-ed-1.22.5' from 'https://cache.nixos.org'...
  copying path '/nix/store/si4q3zks5mn5jhzzyri9hhd3cv789vlm-gcc-15.2.0-lib' from 'https://cache.nixos.org'...
  copying path '/nix/store/lakv43kv98sl6h0ba6wnyg513mcq61vl-gawk-5.4.0' from 'https://cache.nixos.org'...
  copying path '/nix/store/af4a8i43kc2ss4rnmf0swkk2mprsw6xq-gnused-4.9' from 'https://cache.nixos.org'...
  copying path '/nix/store/khhzkpj9169ydnyg7jjrjx7s5ygdkcas-pcre2-10.46' from 'https://cache.nixos.org'...
  copying path '/nix/store/yvrwcs1a45rj8142n0l2w9q9s6akamjr-gnumake-4.4.1' from 'https://cache.nixos.org'...
  copying path '/nix/store/hmslvsxvs2ijb7iw5krdckai2im6vp2y-xz-5.8.3' from 'https://cache.nixos.org'...
  copying path '/nix/store/ixhlv41i2wpl84xgjcks061dz4yssbg3-zlib-1.3.2' from 'https://cache.nixos.org'...
  copying path '/nix/store/zj6r42syyswkhrr174bzppj3n7xhq936-bzip2-1.0.8-bin' from 'https://cache.nixos.org'...
  copying path '/nix/store/zj7mxwji29zvj9vl70iip7gw4h6ljfam-patch-2.8' from 'https://cache.nixos.org'...
  copying path '/nix/store/bifwnk7bvspj2mqc1w7dcydz8lkvfy1q-acl-2.3.2' from 'https://cache.nixos.org'...
  copying path '/nix/store/iscmg3ivhx7z67dz14lrg7p77gnsa4dw-file-5.45' from 'https://cache.nixos.org'...
  copying path '/nix/store/2nm5c858fh52s6mhcffm07s3biaxys44-xz-5.8.3-bin' from 'https://cache.nixos.org'...
  copying path '/nix/store/rnvb7bvp53v2dw7pcwh9xb89x5z4rjib-gnutar-1.35' from 'https://cache.nixos.org'...
  copying path '/nix/store/9lhr1c3l9qzv8pzp3idmii1nwvxxjys3-gzip-1.14' from 'https://cache.nixos.org'...
  copying path '/nix/store/wf7lr2hf43546jc5kwqh3dbxnpcnw1mn-gnugrep-3.12' from 'https://cache.nixos.org'...
  copying path '/nix/store/5yypk94lvsbvskjz5xyav09j5ydxm8za-gmp-with-cxx-6.3.0' from 'https://cache.nixos.org'...
  copying path '/nix/store/66lksljlljdd5ppgvfk8g89y8xgqcxd7-patchelf-0.15.2' from 'https://cache.nixos.org'...
  copying path '/nix/store/jjxngswsb214vb58qx485jhmilf0kxxy-coreutils-9.10' from 'https://cache.nixos.org'...
  copying path '/nix/store/hx084k7pgz4n0vgkvil9gbcnl8y6p1xf-diffutils-3.12' from 'https://cache.nixos.org'...
  copying path '/nix/store/vhsirn9m1ifmnw5g1qczzhvqkx6lw1if-findutils-4.10.0' from 'https://cache.nixos.org'...
  copying path '/nix/store/74ma22y9kdxjvvrrgz3q1dqnm8r4d99d-stdenv-linux' from 'https://cache.nixos.org'...
  building '/nix/store/pbg2xm1rsv08j43rq6p8xfibixb3fhhr-k8s-activation-19-scorecards.drv'...
  Reading package index...
  Loading store graph...
  Reading 6 packages...
  Computing cross-package dependencies...

  Wrote audit bundle to ./compliance
    scorecard: 0 errors, 6 warnings, 2 info
    framework: SOC 2

The directory contains five files:

kix-examples/

❱ find compliance -type f | sort
compliance/assessment-results.json
compliance/audit-report.md
compliance/provenance.json
compliance/sbom.json
compliance/scorecard-results.sarif

audit-report.md is the human-readable summary. The other files provide OSCAL Assessment Results, SLSA provenance, a CycloneDX SBOM, and SARIF scorecard findings.

Select a framework

SOC 2 is the default control mapping. Select another supported framework with --framework:

kix-examples/

❱ kix compliance audit 19-scorecards --out ./compliance-iso27001 --framework iso27001

The accepted values are soc2, iso27001, dora, and nis2.

Replace an existing bundle

Kix refuses to write over an existing output directory. Pass --force when the job intentionally refreshes that directory:

kix-examples/

❱ kix compliance audit 19-scorecards --out ./compliance --force

Archive or upload the directory as one CI artifact so the files from a single evaluation remain together.