Navigate evaluates policy-defined rules at every pipeline checkpoint. Block non-compliant code, capture evidence, and provide clear remediation paths to developers.
Every pipeline run is evaluated against policy-defined controls.
Build, test, or deploy stage reaches a checkpoint.
Navigate evaluates controls defined in the policy profile.
Validates artifacts, thresholds, and required approvals.
PASS, FAIL, PASS_WITH_EXCEPTION, or NOT_APPLICABLE.
Define your compliance requirements in a simple, version-controlled manifest. No complex setup, no separate tools to manage.
# normex.yaml
compliance:
frameworks:
- soc2
- hipaa
checks:
security:
enabled: true
fail_on: critical
dependencies:
enabled: true
license_allowlist:
- MIT
- Apache-2.0
- BSD-3-Clause
secrets:
enabled: true
scan_history: false
code_review:
required_approvers: 2
require_codeowner: true
notifications:
slack: "#security-alerts"
on_failure: trueNative integrations with all major CI/CD platforms.
name: Compliance Check
on:
pull_request:
branches: [main]
jobs:
navigate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Navigate
uses: normex/navigate-action@v1
with:
token: ${{ secrets.NORMEX_TOKEN }}
fail-on: criticalstages:
- test
- compliance
navigate:
stage: compliance
image: normex/navigate:latest
script:
- navigate scan --config normex.yaml
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
allow_failure: falseEvery gate evaluation returns a deterministic outcome with full evidence. Configure hard blocks, soft blocks, and exception workflows by environment.
All compliance checks passed
Navigate runs a comprehensive suite of checks on every pipeline execution.
SAST analysis for vulnerabilities, injection flaws, and insecure patterns.
Validate dependencies against your approved license allowlist.
Prevent accidental commit of API keys, tokens, and credentials.
Enforce required approvers and CODEOWNERS review.
Ensure minimum test coverage thresholds are met.
Check for outdated, deprecated, or vulnerable packages.
Navigate works seamlessly with Atlas and Lens to provide end-to-end compliance coverage from policy definition to code analysis to pipeline enforcement.
Policies and controls defined in Atlas automatically become enforcement rules in Navigate.
Deep code analysis from Lens powers Navigate's compliance checks with richer context.
Pipeline results flow back to Atlas as evidence for audit preparation and compliance reporting.
Pipeline compliance overview
Add stage gate enforcement to your CI/CD and ensure every release meets your compliance standards with full evidence capture.