ISSUE-408HighPipeline Composition

Missing required component

Control: Pipelines must include components· Config key: pipelineMustIncludeComponent

📋 What is this?

A required GitLab catalog component, as defined in your Policy controls, is missing in the project pipeline.

⚠️ Impact

Missing components result in insecure pipeline configurations that don't match your policy. For example, if your pipeline is missing a security scan component, vulnerabilities might go undetected.

🔧 How to fix

Include the missing GitLab catalog component in the CI/CD pipeline configuration of the project.

✗ BeforeThe SAST component is required but missing from the pipeline.

# .gitlab-ci.yml: ❌ Missing required SAST component
include:
  - component: gitlab.com/components/secret-detection/secret-detection@2.4.1
  # Missing: gitlab.com/components/sast/sast (required by policy)

# .plumber.yaml: Requires both SAST and secret detection
# pipelineMustIncludeComponent:
#   enabled: true
#   required: components/sast/sast AND components/secret-detection/secret-detection

✓ AfterBoth required components are included.

# .gitlab-ci.yml: ✅ All required components included
include:
  - component: gitlab.com/components/sast/sast@1.5.2
  - component: gitlab.com/components/secret-detection/secret-detection@2.4.1

💡 Tips

Use expression syntax (AND/OR) in required for complex rules: (sast AND secret-detection) OR full-security.
Alternatively, use requiredGroups with arrays for OR-of-ANDs logic.
The include must match the component path pattern. Check your .plumber.yaml for the exact paths.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    pipelineMustIncludeComponent:
      enabled: true

See the CLI documentation for the full configuration reference. On Plumber Platform, the same key is used in your policy configuration.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues