Add latest changes from gitlab-org/gitlab@15-3-stable-eev15.3.0-rc42

1 files changed, 28 insertions, 9 deletions

diff --git a/doc/user/compliance/compliance_report/index.md b/doc/user/compliance/compliance_report/index.md
index f547e5f146f..4cd2705e917 100644
--- a/doc/user/compliance/compliance_report/index.md
+++ b/doc/user/compliance/compliance_report/index.md
@@ -92,30 +92,49 @@ Our criteria for the separation of duties is as follows:
 
 ## Chain of Custody report
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/213364) in GitLab 13.3.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/213364) in GitLab 13.3.
+> - Chain of Custody reports sent using email [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/342594) in GitLab 15.3 with a flag named `async_chain_of_custody_report`. Disabled by default.
+
+FLAG:
+On self-managed GitLab, by default sending Chain of Custody reports through email is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `async_chain_of_custody_report`. On GitLab.com, this feature is not available.
 
 The Chain of Custody report allows customers to export a list of merge commits within the group.
 The data provides a comprehensive view with respect to merge commits. It includes the merge commit SHA,
 merge request author, merge request ID, merge user, date merged, pipeline ID, group name, project name, and merge request approvers.
 Depending on the merge strategy, the merge commit SHA can be a merge commit, squash commit, or a diff head commit.
 
-To download the Chain of Custody report:
+To generate the Chain of Custody report:
 
 1. On the top bar, select **Menu > Groups** and find your group.
 1. On the left sidebar, select **Security & Compliance > Compliance report**.
 1. Select **List of all merge commits**.
 
-### Commit-specific Chain of Custody Report
+The Chain of Custody report is either:
+
+- Available for download.
+- Sent through email. Requires GitLab 15.3 and later with `async_chain_of_custody_report` feature flag enabled.
+
+### Commit-specific Chain of Custody report
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/267629) in GitLab 13.6.
 
-You can generate a commit-specific Chain of Custody report for a given commit SHA.
+Authenticated group owners can generate a commit-specific Chain of Custody report for a given commit SHA, either:
 
-1. On the top bar, select **Menu > Groups** and find your group.
-1. On the left sidebar, select **Security & Compliance > Compliance report**.
-1. At the top of the compliance report, to the right of **List of all merge commits**, select the down arrow (**{chevron-lg-down}**).
-1. Enter the merge commit SHA, and then select **Export commit custody report**.
-   SHA and then select **Export commit custody report**.
+- Using the GitLab UI:
+
+  1. On the top bar, select **Menu > Groups** and find your group.
+  1. On the left sidebar, select **Security & Compliance > Compliance report**.
+  1. At the top of the compliance report, to the right of **List of all merge commits**, select the down arrow (**{chevron-lg-down}**).
+  1. Enter the merge commit SHA, and then select **Export commit custody report**.
+     SHA and then select **Export commit custody report**.
+
+The Chain of Custody report is either:
+
+- Available for download.
+- Sent through email. Requires GitLab 15.3 and later with `async_chain_of_custody_report` feature flag enabled.
+
+- Using a direct link: `https://gitlab.com/groups/<group-name>/-/security/merge_commit_reports.csv?commit_sha={optional_commit_sha}`, passing in an optional value to the
+  `commit_sha` query parameter.
 
 NOTE:
 The Chain of Custody report download is a CSV file, with a maximum size of 15 MB.