Compliance Documentation Collector
Collect compliance evidence records kept in the repository, such as dated penetration-test records that point to the confidential report, so policies can check the evidence is current.
compliance-docs to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/compliance-docs@v1.0.5
What This Integration Collects
This integration includes 1 collector that gather metadata from your systems.
pentest
Collects penetration-test records from a directory (default: docs/pentests/).
Each record is a Markdown file named for the report date (e.g. 2026-03-14.md
or 2026-03-14-external.md), with optional YAML frontmatter for the provider,
scope and a link to the report. Writes an empty list when there are no records.
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"compliance": {
"penetration_testing": {
"reports": [
{
"date": "2026-03-14",
"path": "docs/pentests/2026-03-14.md",
"provider": "Example Security Ltd",
"scope": "Public API, customer web app",
"report_url": "https://grc.example.com/reports/pentest-2026-03-14"
},
{
"date": "2025-03-02",
"path": "docs/pentests/2025-03-02-external.md",
"provider": "Example Security Ltd",
"scope": "External network"
}
]
}
}
}Configuration
Configure this collector in your lunar-config.yml.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
pentest_dir_paths
|
Optional |
docs/pentests
|
Comma-separated list of candidate directories for pen-test records (first match wins) |
Documentation
View on GitHubCompliance Documentation Collector
Collects compliance evidence records kept in the repository, starting with penetration-test records.
Overview
Pen-test reports are confidential and usually live outside the repository, so a team commits a short record per report instead: a Markdown file named for the report date, pointing at the report. This collector reads those records so a policy can check that the latest report is recent. It records the schedule, not the test results.
Collected Data
The pentest sub-collector scans a directory (default: docs/pentests/) for date-named Markdown files. Only files directly in the directory whose names start with a real YYYY-MM-DD date count:
docs/pentests/
├── 2026-03-14.md
└── 2025-03-02-external.md
The frontmatter is optional:
---
provider: Example Security Ltd
scope: Public API, customer web app
report_url: https://grc.example.com/reports/pentest-2026-03-14
---
# Penetration test, March 2026
This collector writes to the following Component JSON paths. With no records it writes an empty reports list, so a policy can tell a service with no records from one the collector doesn't run on.
| Path | Type | Description |
|---|---|---|
.compliance.penetration_testing.reports[] |
array | One entry per record, newest first |
.compliance.penetration_testing.reports[].date |
string | Report date, from the file name |
.compliance.penetration_testing.reports[].path |
string | Path to the record |
.compliance.penetration_testing.reports[].provider |
string | Who ran the test (frontmatter provider) |
.compliance.penetration_testing.reports[].scope |
string | What was tested (frontmatter scope; a list is joined with commas) |
.compliance.penetration_testing.reports[].report_url |
string | Link to the report (frontmatter report_url) |
Collectors
This integration provides the following collectors (use include to select a subset):
| Collector | Description |
|---|---|
pentest |
Reads date-named penetration-test records |
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/compliance-docs@v1.0.0
on: ["pentest-in-scope"] # The services that need a pen test; pentest-report-recent skips the rest
include: [pentest]
# with:
# pentest_dir_paths: "docs/pentests"
Disaster recovery plans and exercise records are collected by dr-docs.
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from Compliance Documentation Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 300+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements