CI/CD provider

ISSUE-410CriticalPipeline Composition

Security job weakened

Control: Security jobs must not be weakened· Config key: securityJobsMustNotBeWeakened

📋 What is this?

A security scanning job (SAST, Secret Detection, Container Scanning, Dependency Scanning, DAST, License Scanning) has been weakened by overriding its configuration in .gitlab-ci.yml. The pipeline still includes the security template but the actual scanning is neutralized.

⚠️ Impact

Weakened security jobs give a false sense of security. The pipeline appears to include security scanning, but the scans either never run, require manual intervention, or silently ignore failures. Maps to OWASP CICD-SEC-4 (Poisoned Pipeline Execution).

🔧 How to fix

Remove the override that weakens the security job. Security jobs should run automatically on every pipeline and block the pipeline on failure.

✗ BeforeSecurity jobs are present but neutralized through allow_failure, rules override, and when: manual.

# .gitlab-ci.yml: ❌ Security jobs are weakened
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

# Weakened: failures are silently ignored
semgrep-sast:
  allow_failure: true

# Weakened: job will never run
secret_detection:
  rules:
    - when: never

# Weakened: job only runs if manually triggered
container_scanning:
  when: manual

✓ AfterSecurity templates are included without overrides. Configuration is done via variables.

# .gitlab-ci.yml: ✅ Security jobs run as intended
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml

# No local overrides: security jobs run as designed by the templates
# Customization is done through CI/CD variables:
variables:
  SAST_EXCLUDED_PATHS: "test/**"
  SECRET_DETECTION_HISTORIC_SCAN: "false"

# .plumber.yaml
# securityJobsMustNotBeWeakened:
#   enabled: true
#   securityJobPatterns:
#     - "*-sast"
#     - "secret_detection"
#     - "container_scanning"
#     - "*_dependency_scanning"
#     - "dast"
#     - "dast_*"
#     - "license_scanning"
#   allowFailureMustBeFalse:
#     enabled: false   # opt-in (GitLab templates ship with allow_failure: true)
#   rulesMustNotBeRedefined:
#     enabled: true
#   whenMustNotBeManual:
#     enabled: true

💡 Tips

Security jobs are identified by matching job names against securityJobPatterns (wildcards supported). Customize patterns to match your pipeline's security jobs.
The allowFailureMustBeFalse sub-control is off by default because GitLab templates ship with allow_failure: true. Enable it if your org wants security checks to block the pipeline.
rulesMustNotBeRedefined and whenMustNotBeManual are on by default since these patterns effectively disable scanning.
Each sub-control can be toggled independently for gradual adoption.

⚙️ Configuration

This control is configured in .plumber.yaml under the gitlab section:

gitlab:
  controls:
    securityJobsMustNotBeWeakened:
      enabled: true

See the CLI documentation for the full configuration reference.

ISSUE-410CriticalPipeline Composition

Security job weakened

Control: Security jobs must not be weakened· Config key: securityJobsMustNotBeWeakened

📋 What is this?

A security-scan job in a GitHub Actions workflow sets continue-on-error: true, so the pipeline stays green even when the scan fails or finds issues. Only the literal boolean is detected; expressions like continue-on-error: ${{ ... }} cannot be proven on statically and are not flagged.

⚠️ Impact

A weakened security scan gives a false sense of security - the pipeline reports green, but the scan either never ran or its findings were silently ignored. Same OWASP CICD-SEC-4 pattern as on GitLab.

🔧 How to fix

Remove the weakening pattern. Security scans should fail the pipeline, not pass with warnings.

✗ BeforeScan findings never fail the pipeline; the job reports green regardless.

# .github/workflows/codeql.yml: ❌ Weakened
jobs:
  analyze:
    runs-on: ubuntu-latest
    continue-on-error: true   # ← findings ignored
    steps:
      - uses: github/codeql-action/analyze@v3

✓ AfterPipeline fails the merge if CodeQL finds an issue.

# .github/workflows/codeql.yml: ✅ Runs on every push, fails on findings
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.27.6

# .plumber.yaml
github:
  controls:
    securityJobsMustNotBeWeakened:
      enabled: true
      securityJobPatterns: [codeql, semgrep, snyk, trivy]

💡 Tips

Plumber identifies security jobs by glob-matching against <workflow-file-basename-without-.yml>/<job-id>. The full pattern reference (four shapes, real-world slash-form examples) lives in the CLI documentation's Security Job Weakening Detection section.
Customise securityJobPatterns for your stack. The defaults ship wildcard-wrapped (*codeql*, *-sast, *scan*, ...) so they catch project-specific prefixes; you can drop the wildcards once you know your workflow-file layout.
continue-on-error: true is only flagged on jobs matching the security patterns; on other jobs (a flaky-test shard, an experimental matrix leg) it is fine.

⚙️ Configuration

This control is configured in .plumber.yaml under the github section:

github:
  controls:
    securityJobsMustNotBeWeakened:
      enabled: true

See the CLI documentation for the full configuration reference.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configuration

🔗 Related issues