Menu

📰
0

Hardening GitLab CI/CD with an open-source pipeline linter

DEV Community: gitlab·Thib·about 1 month ago
#vwjB56XW
#dev#available#class#code#strong#plumber
Reading 0:00
15s threshold

Most GitLab linters tell you if your YAML is valid. Very few tell you if your YAML is dangerous . It's easy to feel safe when you see a green build, but a "successful" pipeline can still have major governance gaps. A green checkmark won't tell you if: Your pipeline uses mutable :latest tags or untrusted registries. A developer accidentally disabled a security job with allow_failure: true . Your "protected" branch settings are actually misconfigured. Sensitive variables are being leaked via CI_DEBUG_TRACE . We built Plumber to bridge the gap between "valid syntax" and "secure configuration." It's an open-source CLI that checks both your .gitlab-ci.yml and your GitLab project settings to see if they meet your organization's compliance standards. Beyond Linting: The PBOM One of the most powerful features is the Pipeline Bill of Materials (PBOM) . Plumber can export a CycloneDX SBOM specifically for your CI/CD.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More