GitLab organization Severitycritical builtIn

Description

Top-level groups should prevent project forks from leaving the group boundary. When prevent_forking_outside_group is true, members can only fork projects within the same group hierarchy. This setting is a Premium/Ultimate feature on GitLab Group objects and is also configurable per-project via forking_access_level. https://docs.gitlab.com/ee/user/group/access_and_permissions.html#prevent-group-members-from-forking-projects-outside-the-group

Recommendation

1. Go to your top-level Group Settings > General. 
2. Expand the Permissions and group features section. 
3. Enable Prevent group members from forking projects outside the group (sets prevent_forking_outside_group = true). 
4. Save changes. Note: this setting requires GitLab Premium or Ultimate and applies to the top-level group only. 
5. (Optional) For finer-grained control, set forking_access_level to disabled on individual projects via the project Settings > General > Visibility, project features, permissions.

Policy Rule

{
  "target": "GLGroup",
  "if": {
    "allOf": [
      {
        "resource": "GLGroup",
        "property": "PreventForkingOutsideGroup",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}