DOS6063

Project integration should subscribe to pipeline events

DOS6063

GitLab organization Severitymedium builtIn

Description

Notification integrations (Slack, MS Teams, generic webhooks) attached to a project should have PipelineEvents enabled so that pipeline failures and status changes are surfaced to the operations channel. A misconfigured integration that only emits push events (and not pipeline events) silently masks build / test / deployment failures, allowing broken pipelines to go unnoticed. Reference: https://docs.gitlab.com/ee/user/project/integrations/webhook_events.html#pipeline-events

Recommendation

1. In GitLab, navigate to the project: Settings > Integrations. 2. Click on the notification integration (e.g., Slack, Webhooks). 3. Under 'Triggers', check the 'Pipeline events' box. 4. Save changes. 5. Validate by manually triggering a pipeline and confirming the notification reaches the destination channel.

Policy Rule

{
  "target": "GLProjectIntegration",
  "if": {
    "allOf": [
      {
        "resource": "GLProjectIntegration",
        "property": "PipelineEvents",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS6062 DOS6064 »
Rule Details
  • Rule ID: DOS6063
  • Code: GL_Project_Integration_PipelineEvents_Should_Be_True
  • Platform: GitLab
  • Category: organization
  • Severity: Severitymedium
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2