feat(compliance): add compose policy checks

[Ericliu-uz]

Summary

Adds the first compliance-as-code checks for docker-compose.yml. This PR introduces Conftest policies for service resource limits and healthchecks, Rego unit tests and fixtures, and a GitHub Actions workflow that verifies the policy and reports the current Compose findings without blocking CI.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor / code cleanup
• Documentation
• CI/CD / infrastructure
• Security

Affected Components

• /backend-api
• /frontend
• /engine (collectors / policies)
• /security
• /infrastructure
• /.github/workflows
• /policy (repository compliance policies)
• /docs

Motivation

Converts the completed baseline audit findings into repeatable checks for missing Compose resource limits and healthchecks. The initial implementation detects the known findings on db, redis, and worker while keeping the workflow report-only until an enforcement approach is agreed.

Testing Done

• Unit tests pass locally
• Tested manually — describe how:
  • Ran conftest verify --policy policy/compose — 5 Rego unit tests passed.
  • Ran conftest test --policy policy/compose policy/fixtures/compose/compliant.yml — compliant fixture passed.
  • Ran conftest test --no-fail --policy policy/compose docker-compose.yml — reported the expected findings for db, redis, and worker without blocking the command.
  • GitHub Actions Compliance Policy Checks workflow passed, including policy verification, compliant-fixture validation, and current Compose reporting.
• No tests required — explain why:

Security Considerations

The policies make missing resource limits and healthchecks visible during review. The workflow reports the current baseline findings without blocking CI, so it introduces no immediate deployment or availability impact. No secrets, credentials, or tokens are added.

Breaking Changes

• No breaking changes
• Yes — describe below:

Rollback Plan

• Revert commit is sufficient
• Requires additional steps — describe below:

Checklist

• Code follows project conventions
• No secrets, credentials, or tokens committed
• Relevant documentation updated (if applicable)
• CI/CD workflows pass on this branch
• PR is focused on one thing

[github-actions]

Preview Environment

A preview environment can be spun up on demand for this PR.

Action	Label	Includes
Spin up preview	deploy-preview	Frontend, backend, database, Redis, OPA, worker
Spin up preview with M365	deploy-preview-m365	Everything above + PowerShell service for Exchange/Teams scan testing
Tear down preview	teardown-preview	Stops the environment early

The environment will also be torn down automatically when the PR is closed or merged.
Preview URLs will appear in a follow-up comment once the deploy completes (~5–8 min).
M365 scans require real tenant credentials added through the frontend UI.

[khan-deakin]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9351ebdf8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject disabled Compose healthchecks

When a service sets healthcheck.test to ["NONE"] (Docker Compose's documented way to disable a healthcheck), count(test) > 0 evaluates true, so the deny rule treats that service as compliant even though Compose will not run any readiness check. This leaves a false negative in the new compliance gate for the missing-healthcheck condition; reject NONE and require CMD/CMD-SHELL with an actual command.

Useful? React with 👍 / 👎.