Compliance-as-code: control→regulation mapping + ITGC-SEC-06 remediation with CI gate

[devin-ai-integration]

Summary

Compliance-as-code demo for a payments customer (Global Payments). Maps this repo's
FINOS-Common-Cloud-Controls-style RACM (audit/racm.yaml) to payments regulations, re-performs
every control against the real code, then remediates one high-severity FAIL and wires it into CI
as a gate. Based on devin/1781883529-group-audit-demo-kit so the audit ontology is present and
the diff is minimal.

1. Control-to-regulation matrix — audit/compliance/gpn_control_mapping.md
Maps all 11 RACM controls to PCI DSS 4.0 / SOX (ICFR) / GDPR, each with control_id, regulation
refs, nature, PASS/FAIL result, and file:line evidence from the code. Baseline: 10 FAIL, 1 PARTIAL.
High-severity FAILs: APP-TXN-01, APP-TXN-02, APP-TXN-03, ITGC-SEC-06, ITGC-CM-07.

2. Remediation of ITGC-SEC-06 (Credential & secrets management)
Maps to PCI DSS 4.0 Req 8.6.2 (no hard-coded passwords in property files), Req 2.2 / 3.x,
SOX ICFR, GDPR Art. 32. DB credentials externalized from application.properties:

- spring.datasource.username=root
- spring.datasource.password=Test@123
+ spring.datasource.username=${SPRING_DATASOURCE_USERNAME:root}
+ spring.datasource.password=${SPRING_DATASOURCE_PASSWORD}   # no in-source default by design

CredentialManagementControlTest re-performs the control (plain JUnit, no Spring/DB): parses
application.properties and fails unless every secret-bearing property is a bare ${ENV} reference
(rejects literals and inline ${PW:default} fallbacks), and asserts Test@123 no longer appears.

3. CI gate — .github/workflows/compliance-gate.yml + audit/compliance/ci/check_committed_secrets.sh
Runs on every push/PR: a fast bash secret-scan followed by the JUnit control re-performance. Fails the
build if the control regresses (a secret is re-committed), mirroring the CCM model in
audit/ccm/continuous-controls-monitoring.md.

Verification

• ./mvnw clean test → 4 tests pass (existing contextLoads() + 3 new control tests); app boots with
  env-injected credentials (Hikari connects to MySQL).
• Bash gate: PASS [ITGC-SEC-06]. Negative checks confirmed: reintroducing Test@123 or a
  ${PW:default} fallback fails both the script and the test.

Scope

Minimal and focused — no broad refactor. The other 9 FAIL / 1 PARTIAL controls remain documented (not
fixed) in the mapping for the auditor to conclude on.

Link to Devin session: https://app.devin.ai/sessions/76129a35537f46f4a773fd16c8e5a6f2
Requested by: @achalc

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring