ISSUE-404MediumPipeline Composition

Forbidden include version

Control:CTRL-404Pipeline must not use forbidden ref in includes

📋 What is this?

A CI/CD template in your pipeline is included using a version that is forbidden by your configuration.

⚠️ Impact

Using forbidden tags can result in insecure templates running in your CI/CD pipelines or unexpected breaking changes. For instance, if you include a template using the main version (default branch of the source repository), it might pull a compromised, untested, or breaking template.

🔧 How to fix

Update the template include version to a version allowed by your Policy controls.

✗ Before`latest`, `main`, and `HEAD` are mutable and forbidden.

# .gitlab-ci.yml: ❌ Uses forbidden version references
include:
  - component: gitlab.com/components/sast/sast@latest

  - project: my-org/ci-templates
    ref: main
    file: /templates/security.yml

  - component: gitlab.com/my-org/custom-scanner/scan@HEAD

✓ AfterSpecific version tags ensure reproducible pipelines.

# .gitlab-ci.yml: ✅ Uses specific version tags
include:
  - component: gitlab.com/components/sast/sast@1.5.2

  - project: my-org/ci-templates
    ref: v2.1.0
    file: /templates/security.yml

  - component: gitlab.com/my-org/custom-scanner/scan@3.0.1

💡 Tips

Default forbidden versions: latest, ~latest, main, master, HEAD.
Set defaultBranchIsForbiddenVersion: true to also forbid using the project's default branch name.

⚙️ Configure this control

On the Plumber Platform: open the Policies page and set control CTRL-404 on the policy that governs the project.

With the CLI alone: set it in your configuration file. Every field and default is in the controls configuration reference, CTRL-404.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configure this control

🔗 Related issues