Achieving compliance in DevSecOps pipelines