Hardcoded job

📋 What is this?

A job in the pipeline configuration is hardcoded, increasing maintainability costs and introducing a risk of drifting from your organization's standards.

⚠️ Impact

🔧 How to fix

Replace the hardcoded job in the project CI/CD configuration with a template or component inclusion.

# .gitlab-ci.yml: ❌ Jobs defined directly (hardcoded)
stages:
  - test
  - build
  - deploy

test:
  stage: test
  image: python:3.12
  script:
    - pip install pytest
    - pytest tests/

build:
  stage: build
  image: docker:27
  script:
    - docker build -t $CI_REGISTRY_IMAGE .
    - docker push $CI_REGISTRY_IMAGE

# .gitlab-ci.yml: ✅ Jobs from CI/CD components and includes
include:
  # CI/CD Component from the catalog
  - component: gitlab.com/components/sast/sast@1.2.0
  # Shared template from another project
  - project: my-org/ci-templates
    ref: v2.1.0
    file: /templates/docker-build.yml

stages:
  - test
  - build
  - deploy

# Only project-specific configuration remains
variables:
  DOCKER_IMAGE_NAME: my-app

💡 Tips

• Browse the GitLab CI/CD Catalog for reusable components.
• Create shared templates in a dedicated project for organization-specific jobs.
• Some project-specific jobs may be acceptable. Discuss with your team what should be centralized.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    pipelineMustNotIncludeHardcodedJobs:
      enabled: true

See the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.

🔗 Related issues