07 · Software Supply Chain Security & Audit

Milestones of the roadmap items in this theme

As of 2026-10-22 · today

Gantt

#	Milestone	Start	Target	Status	Waits for	Team	Epic	Derived
20 · End-to-End Build Auditing
20.1	Audit ingest in production, with Backstage producing	2026-07-06	2026-10-30	in progress	—	SRE	—	—
20.2	Build event shape and correlation key settled	—	2027-05-21	planned	20.1	SRE	—	waiting 20.1
20.3	Every build and deployment emits an event, from the shared template	—	2028-09-08	planned	15.3, 20.2	SRE	—	waiting 15.3, 20.2
20.4	Request to deployment answerable as one query	—	2029-01-12	planned	20.3, 22.3	SRE	—	waiting 20.3, 22.3
21 · Vulnerability Management (DefectDojo)
21.1	DefectDojo under IaC/GitOps with SSO — products and engagements modelled per repository	—	2026-10-23	planned	—	SRE	—	—
21.2	All pipeline scanners report into DefectDojo — deduplicated, linked to the build	—	2026-12-18	planned	21.1	SRE	—	waiting 21.1
21.3	SLA policy live and the release gate reads DefectDojo	—	2027-02-12	planned	21.2	SRE	—	waiting 21.2

20.1Audit ingest in production, with Backstage producing2026-10-30in progress · 2/4

Ingest service in production: Zitadel M2M auth and the BigQuery sinkowner · Charlesarchitecture →
Backstage wired as a producerowner · Charles
Write-only verified, not assumed: no producer credential also grants readowner · TBD
Write-only is what makes this evidence rather than a database. A producer credential that can also read breaks nothing, shows up nowhere in the code, and quietly costs the trail its value — so it has to be checked rather than trusted.
Retention and partition expiry set on the tableowner · TBD
An audit trail with no stated retention answers a compliance question badly in both directions — too short and the evidence is gone, too long and it is a liability nobody chose.

20.2Build event shape and correlation key settled2027-05-21planned · 0/4

Action names, target_id and metadata agreed for build and deployment eventsowner · TBD
One correlation key reaching the pipeline logs, the trace and the scan resultsowner · TBD
The envelope's correlation_id is documented as a trace id, and 19.1 makes structured logs carry one. The key already exists in both designs — this task is agreeing to use it as the same key rather than inventing a second.
Logs and dependency manifests stay out of the envelope, by decisionowner · TBD
The envelope has no message body, and the table is partitioned and clustered for filterable events. Pipeline output in the metadata column would be both a misuse and a cost problem — and would stand up a third log store just as item 19 retires the second.
Settled before the pipeline rewrite, so emission lands with itowner · TBD
This milestone deliberately does not wait for 15.3. Deciding the shape afterwards would mean a second pass over every pipeline that 15.3 has just rewritten.

20.3Every build and deployment emits an event, from the shared template2028-09-08planned · 0/4

Emission in the shared GitLab CI template, not per pipelineowner · TBD
Waiting for 15.3 costs item 20 its completion date and buys doing this once. Built into Jenkins pipelines now, it would be rewritten along with them.
Each build recording who, when, which revision and which artefactowner · TBD
Deployments emitting too, which is what 14.3 asks forowner · TBDarchitecture →
14.3 removes the person from the deployment trigger; its audit task keeps the answer to who is accountable by moving it to the merge. This is where that event actually gets written.
The event points at the dependency manifest rather than carrying itowner · TBD
21.2's SCA scanners already inventory dependencies into DefectDojo. Recording a pointer keeps one copy; carrying the manifest would make a second that can disagree with the first.

20.4Request to deployment answerable as one query2029-01-12planned · 0/3

The chain joined: who applied, who approved, which MR, which build, which artefact, which deploymentowner · TBD
Backstage records the request and the approval and its scaffolder opens the MR; the producer for that already exists. 22.3 is where those events gain the correlation key that lets the rest of the chain join to them, so this milestone waits on it.
A real incident replayed against the trail as the testowner · TBD
A schema review says the fields are present. Replaying an investigation says whether the questions people actually ask can be answered — and those are different findings.
Query access separated from producer accessowner · TBD
The reader role exists in the API; this is where it is given to people rather than to producers, which is the same separation 20.1 verifies from the other side.

21.1DefectDojo under IaC/GitOps with SSO — products and engagements modelled per repository2026-10-23planned · 0/3

Helm/GitOps manifests for the existing instance, configuration exported as codeowner · Charles
Rebuild beside the running instance and cut over — the build-before-break pattern of item 02.
SSO via OIDC, roles mapped from groupsowner · TBD
Product / engagement model per repository, imported from the GitLab group treeowner · TBD

21.2All pipeline scanners report into DefectDojo — deduplicated, linked to the build2026-12-18planned · 0/3

21.3SLA policy live and the release gate reads DefectDojo2027-02-12planned · 0/3

Back to the Platform Roadmap overview · the direction behind these milestones is the Platform Roadmap.