Comma

Share an InSpec report

A compliance run produces two categories of failing control: the ones that are being fixed and the ones that have been accepted, with a reason, by someone with the authority to accept them. Both are red. The difference between them lives in a spreadsheet, a ticket system, or nowhere at all.

Which is why every audit begins by reconstructing decisions that were already made.

Publish it

inspec exec "$PROFILE" -t "$TARGET" \
  --reporter "html2:report.html" || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html report.html \
        --arg title "InSpec — $PROFILE — $TARGET — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because InSpec exits non-zero when controls fail, which is every run worth publishing.

One report id per profile-and-target pair. PATCH appends a revision per run, so the target has a compliance history rather than a snapshot.

Use a scoped token with reports:write only, and keep the report private or team-visible — see the sharing model.

What the URL changes

  • Exceptions live on the control. "Accepted until the image rebuild, RISK-42" pinned where the next reviewer will find it. See commenting on HTML.
  • Auditors read a link. No Chef install, no target credentials, no screen-share.
  • A pass-rate trend. Revision per run at one URL. See revisions and diffs.
  • Scheduled runs. A routine re-runs the profile monthly — see monthly compliance digests.

Limits

  • HTML body: 5 MB. A large profile against many targets can exceed it; publish per target, which is the more useful shape anyway.
  • Scripts run, sandboxed: allow-scripts, no allow-same-origin.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

Related