CRA Gate now available

Know what blocks your release.

ShipGate turns release obligations into evidence, decisions, and fixes. Connect a GitHub repo, declare what you're shipping, and clear the gates that actually apply — from the EU Cyber Resilience Act to open-source licence obligations.

Run a scan Scan a public repo

No compliance score. No giant GRC dashboard. Just blockers, evidence, and fixes.

ship.ermaz.app / public scan

CRA-EU-2026.08.4

GitHub repository

Runs a real scan of any public GitHub repository against the CRA rule pack.

EU release gate — example result

acme/widget

BLOCKED

3blockers

4reviews

18passed

Example finding · fix available

No release SBOM found

BLOCKER

ShipGate found dependency manifests, but no CycloneDX or SPDX SBOM generated with releases.

package.json · package-lock.json · .github/workflows/release.yml

✓ ShipGate can fix this safely

Proposed pull request

ShipGate: add release SBOM workflow

SAFE FIX

+ .github/workflows/sbom.yml
+ release artifact: sbom.cdx.json

No factual compliance claim is inserted. ShipGate only adds the mechanical release workflow and leaves product-specific assertions for you to approve.

How it works

A release gate, not a compliance percentage.

ShipGate separates what code can prove from what only your team can answer. Every unresolved item becomes one of three actions, and every finding is labeled by provenance: Observed (found in the repo), Derived (deterministic rule), Declared (manufacturer answer), or Reviewed (human-accepted).

Fix

A mechanical issue ShipGate can change safely: add an SBOM workflow, pin an action, create a security-policy skeleton, or update release configuration.

FIX IN PR

Prove

You may already satisfy the requirement, but ShipGate cannot see the evidence. Point it to the policy, process, test result, or repository file that proves it.

SHOW EVIDENCE

Answer

Some facts do not live in source code: intended use, support period, markets, classification, or organizational responsibility. Your team answers them explicitly.

MANUFACTURER INPUT

The ShipGate model

From repository to release receipt.

Every result is tied to a repository state, a product context, and a versioned ruleset.

01ConnectSelect a GitHub repo or scan a public repository.

02DescribeTell ShipGate what you ship, where, and how it is distributed.

03CheckRun only the gates that actually apply to that product.

04ResolveFix, prove, or answer every unresolved release item.

05ReceiptGenerate a commit-specific record of what passed and what remains reviewed.

Example CI output

Run Ermaz ShipGate

CRA Gate
────────────────────────────────
PASS WITH 2 REVIEWS

Commit:     a83e91f
Ruleset:    CRA-EU-2026.08.4
Manifest:   .shipgate/product.yml

0 blockers
2 manufacturer reviews
21 controls evidenced

Receipt: SG-2026-A83E91F

First gate: EU CRA

Checks the repository evidence that actually matters.

ShipGate does not pretend GitHub can answer every regulatory question. It automates the parts a repository can genuinely evidence and asks humans for the rest.

✓SBOM generation and release artifacts

✓Dependency manifests, lockfiles, and known vulnerability signals

✓SECURITY.md and vulnerability reporting route

✓Supported-version and security-update documentation

✓CI security checks and dependency-update automation

✓GitHub Action pinning and release-provenance signals

✓Licence inventory and third-party component evidence

✓Technical-documentation skeleton and open evidence gaps

Versioned rulesets

Your code can stay the same while the rules change.

ShipGate versions each regulatory rule pack. When guidance or evidence expectations change, you get a rules diff instead of discovering it at the next audit.

Illustrative ruleset diffCRA-EU-2026.08 → 2026.08.1 (example)

support_period:

- declared duration

+ declared duration

+ rationale / supporting evidence

Repository unchanged · review required

Built for developers

The compliance state lives with the code.

ShipGate can keep a small, reviewable manifest in the repository so release evidence is version-controlled instead of trapped in a dashboard.

.shipgate/product.yml

schema: 1

product:
  name: Acme Desktop
  type: desktop_application

markets:
  - EU

distribution:
  commercial: true
  open_source: false

support:
  security_updates_until: 2031-08-07

cra:
  sbom:
    status: verified
    evidence:
      - .github/workflows/sbom.yml

  vulnerability_reporting:
    status: verified
    evidence:
      - SECURITY.md

ship.ermaz.app

One answer before release: can we ship this?

Connect a repo, clear the gates that apply, and turn mechanical blockers into a pull request.

Run a scan Scan a public repo

ShipGate is release-readiness software, not a conformity assessment body and not a certification service.