ISSUE-406MediumPipeline Composition

Forbidden override of required template

Control: Pipelines must include templates· Config key: pipelineMustIncludeTemplate

📋 What is this?

A required CI/CD template, as defined in your Policy controls, has been overridden in the project pipeline.

⚠️ Impact

Overriding required templates can lead to insecure pipelines that bypass your policy. For example, overriding a SAST template might bypass mandatory checks.

🔧 How to fix

Remove overrides from the project CI/CD configuration. If overrides are relevant, include them in the required template or create a new one.

✗ BeforeThe template's security-scan job is overridden and made manual.

# .gitlab-ci.yml: ❌ Overrides required template job
include:
  - project: my-org/ci-templates
    ref: v2.1.0
    file: /templates/security.yml

# Overrides the security-scan job from the template
security-scan:
  script:
    - echo "Security scan disabled for speed"
  when: manual

✓ AfterTemplate jobs run as designed, configuration via variables.

# .gitlab-ci.yml: ✅ Template included without overrides
include:
  - project: my-org/ci-templates
    ref: v2.1.0
    file: /templates/security.yml

# No local overrides: template jobs run as designed
# Use variables for customization:
variables:
  SECURITY_SCAN_LEVEL: "high"

💡 Tips

Design templates with configurable variables so teams don't need to override jobs.
Plumber shows exactly which job keys are overridden in the issue details.
Consider making critical template jobs non-overridable by design.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    pipelineMustIncludeTemplate:
      enabled: true

See the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues