Pipeline enables CI debug trace

📋 What is this?

The pipeline enables CI_DEBUG_TRACE or CI_DEBUG_SERVICES, which causes GitLab CI to print all environment variables, including secrets, in the job logs.

⚠️ Impact

🔧 How to fix

Remove CI_DEBUG_TRACE and CI_DEBUG_SERVICES from your pipeline configuration. These should only be used temporarily for local debugging and must never be committed.

# .gitlab-ci.yml — ❌ Debug trace enabled (CRITICAL)
variables:
  CI_DEBUG_TRACE: "true"    # Exposes ALL secrets in logs!

deploy:
  stage: deploy
  variables:
    CI_DEBUG_SERVICES: "true"  # Also exposes secrets
  script:
    - deploy.sh

# .gitlab-ci.yml — ✅ Debug trace removed
variables:
  # CI_DEBUG_TRACE removed

deploy:
  stage: deploy
  script:
    - deploy.sh

# For debugging, use these safer alternatives:
#   - Add specific echo/print statements
#   - Use 'set -x' for specific script sections only
#   - Run a debug pipeline with limited access

💡 Tips

• If you need to debug a CI job, use set -x in specific script lines instead of CI_DEBUG_TRACE.
• If debug trace was ever enabled, **rotate all secrets** that may have been exposed in logs.
• Configure pipelineMustNotEnableDebugTrace.forbiddenVariables to also flag other sensitive debug variables.
• Consider setting up CI job log retention policies to limit exposure window.

⚙️ Configuration

This control is configured in .plumber.yaml under the key:

controls:
  pipelineMustNotEnableDebugTrace:
    enabled: true

See the CLI documentation for the full configuration reference.

🔗 Related issues