A
Controls enabled 16/20
- MR approval rules must cover all protected branches
- MR approval rules must require a minimum number of approvals
- Pipeline must not contains hardcoded jobs
- Security jobs must not be weakened
- Project must have a security policy sourceoff by default
- Branch must be protected
- CI/CD variables must be masked
- CI/CD variables must be protected
- Container images must come from authorized sources
- Container images must not use forbidden reference
- Includes must not use ambiguous tag/branch refs
- MR approval settings must be compliant
- MR settings must be compliant
- Pipeline must not enable debug trace
- Pipeline must not execute unverified scripts
- Pipeline must not override job variables
- Pipeline must not use Docker-in-Docker
- Pipeline must not use forbidden ref in includes
- Pipeline must not use unsafe variable expansion
- Pipeline must use only up-to-date includes
- Pipelines must include components
- Pipelines must include templates
- componentMustComeFromAuthorizedSources
- functionMustComeFromAuthorizedSources
This is a custom Plumber score, computed from this repository's own Plumber configuration, not an official Plumber-validated score.