DOS6040

Protected branch should not allow force push

DOS6040

GitLab repository Severityhigh builtIn

Description

Protected branches should set allow_force_push = false. Force push rewrites history on the protected branch, breaking downstream clones and bypassing the audit trail of merge-request reviews. Even Maintainers should not have force-push privilege on critical branches.

En savoir plus

Recommandation

1. Go to project Settings > Repository > Protected branches. 
2. For each protected branch, ensure Allowed to force push is empty (no roles selected). 
3. Save changes.

Règle de politique

{
  "target": "GLProtectedBranch",
  "if": {
    "allOf": [
      {
        "resource": "GLProtectedBranch",
        "property": "AllowForcePush",
        "operator": "equals",
        "value": false
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS6039 DOS6041 »
Détails de la règle
  • ID de la règle: DOS6040
  • Code: GL_Branch_ForcePush_Should_Be_Disabled
  • Plateforme: GitLab
  • Catégorie: repository
  • Sévérité: Severityhigh
  • Type: builtIn
Règles connexes

Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2