A
Controls enabled 13/20
- CI/CD variables must be masked
- CI/CD variables must be protected
- MR approval rules must cover all protected branches
- MR approval rules must require a minimum number of approvals
- MR approval settings must be compliant
- componentMustComeFromAuthorizedSources
- functionMustComeFromAuthorizedSources
- MR settings must be compliantoff by default
- Pipelines must include componentsoff by default
- Pipelines must include templatesoff by default
- Project must have a security policy sourceoff by default
- Branch must be protected
- Container images must come from authorized sources
- Container images must not use forbidden reference
- Includes must not use ambiguous tag/branch refs
- Pipeline must not contains hardcoded jobs
- Pipeline must not enable debug trace
- Pipeline must not execute unverified scripts
- Pipeline must not override job variables
- Pipeline must not use Docker-in-Docker
- Pipeline must not use forbidden ref in includes
- Pipeline must not use unsafe variable expansion
- Pipeline must use only up-to-date includes
- Security jobs must not be weakened
This is a custom Plumber score, computed from this repository's own Plumber configuration, not an official Plumber-validated score.