Skip to content

Monthly compliance run

ContributorsMyles Henaghan

Contributors 🕹️ Myles Henaghan

Orchestrates a portfolio compliance cycle. Confirm the registry path with the user; a common location is docs/management/compliance/repos.yml.

When to use

  • Monthly portfolio review (YYYY-MMM-portfolio-review.md)
  • Change-throughput window (typically last 30 calendar days)
  • Quarterly control-adoption refresh (same month as needed)
  • Monthly dataops-quality for Databricks repos

Gate — before any scans

  1. sync-portfolio-repos — all portfolio_monthly.change-throughput repos reachable.
  2. verify_registry_branches.py — from repo root: python library/skills/change-throughput/scripts/verify_registry_branches.py
  3. Confirm measurement window and reviewer name for the portfolio run summary.

Execution order

  1. Change throughput — change-throughput for each repo in portfolio_monthly.change-throughput. A repo with integration_branch set needs two rows (deploy trunk and integration branch), not one.
  2. Control adoption (quarterly) — control-adoption prompt for repos with enabled_scans: control-adoption; update control-matrix.yml.
  3. DataOps — dataops prompt for repos with monthly dataops-quality; run check_ci_bundle_paths.py on DAB clones.
  4. reviews/YYYY-MM.yml — one entry per repo × scan; include optional clone_health: {synced, ref_used, note} when pull was unsafe. At month level add:
  5. verifications — team must confirm (merge policy, ADO gates, secret scan, workspace monitoring).
  6. recommendations — prioritized portfolio or repo actions (DataOps, git policy, quality gates).
  7. Portfolio review — create/update docs/management/compliance/scans/YYYY-MMM-portfolio-review.md with run summary, Reviews-and-drift jump tables, and throughput/control sections.

Cross-check — before handoff

After the portfolio review is written, confirm throughput roll-up tables are complete:

  1. Count repos in portfolio_monthly.change-throughput in the portfolio registry (often docs/management/compliance/repos.yml). Each repo with integration_branch set adds one extra summary row (deploy trunk plus integration branch).
  2. Every scoped repo must appear in both:
  3. ### Progress since … (month-over-month meaningful IF)
  4. ### Batch size (net commits per landing)
  5. Run from repo root:
python library/skills/change-throughput/scripts/verify_portfolio_throughput_tables.py \
  --portfolio-review docs/management/compliance/scans/YYYY-MMM-portfolio-review.md

Exit 0 required before marking the monthly run complete. Fix missing rows or update portfolio_monthly if scope changed.

Outputs

Artefact Path
Per-repo evergreen docs/management/compliance/scans/<repo_id>/ongoing-*-review.md
Raw JSON docs/management/compliance/scans/<repo_id>/raw/
Run log docs/management/compliance/reviews/YYYY-MM.yml
Roll-up docs/management/compliance/scans/YYYY-MMM-portfolio-review.md

References