ISSUE-407HighRemovedPipeline Composition

Invalid pipeline composition

Control: Pipeline must include required phases· Config key: pipelineMustIncludeRequiredPhases

This code is no longer produced. It came from the static engine that preceded the Plumber CLI; the CLI is now the only analysis engine and its catalog declares no pipelineMustIncludeRequiredPhases control. The closest shipping checks are ISSUE-405 (required template) and ISSUE-408 (required component). The ISSUE-407 code is retired and will not be reused.

📋 What is this?

The Plumber CLI no longer emits this code: pipelineMustIncludeRequiredPhases is not part of the CLI control catalog. The project's CI pipeline does not include all the required actions defined by your configuration.

⚠️ Impact

Missing actions in the pipeline can lead to unverified code being deployed. This increases the risk of security vulnerabilities, policy violations, and software defects reaching production. For example, if security checks are absent, a vulnerable application can be deployed in production and lead to user data leak.

🔧 How to fix

Ensure that the CI pipeline includes all required validations as defined in your Policy controls.

✗ BeforeThe pipeline skips required test and security scan phases.

# .gitlab-ci.yml: ❌ Missing required pipeline phases
stages:
  - build
  - deploy
  # Missing: test, security-scan (required by policy)

build:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE .

deploy:
  stage: deploy
  script:
    - kubectl apply -f k8s/
  # Deploying without testing or security scanning!

✓ AfterAll required pipeline phases are present before deployment.

# .gitlab-ci.yml: ✅ All required phases present
stages:
  - build
  - test
  - security-scan
  - deploy

build:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE .

test:
  stage: test
  script:
    - pytest tests/

include:
  - component: gitlab.com/components/sast/sast@1.5.2

deploy:
  stage: deploy
  script:
    - kubectl apply -f k8s/

💡 Tips

Define required pipeline phases in your Plumber Platform policy under pipelineMustIncludeRequiredPhases.requiredPhases.
Use job name patterns to detect required phases across different pipeline implementations.
Consider blocking deployments if required phases are missing using GitLab protected environments.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

🔗 Related issues