DOS6064

Pipeline schedule should be active

DOS6064

GitLab organization Severitymedium builtIn

Description

Pipeline schedules listed on a project should be Active. An inactive schedule is configuration drift: either the schedule is no longer needed (and should be deleted) or it has been silently paused, which causes scheduled work (nightly builds, periodic security scans, scheduled deployments) to silently stop running. Auditing the Active flag forces a deliberate decision. Reference: https://docs.gitlab.com/ee/ci/pipelines/schedules.html

Recommendation

1. In GitLab, navigate to the project: Build > Pipeline schedules. 2. For any schedule listed as 'Inactive', either: (a) click the play icon to re-activate it if the schedule is still needed; or (b) click the trash icon to delete the schedule if it is obsolete. 3. Confirm the next_run_at timestamp is in the future.

Policy Rule

{
  "target": "GLPipelineSchedule",
  "if": {
    "allOf": [
      {
        "resource": "GLPipelineSchedule",
        "property": "Active",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS6063 DOS6065 »
Rule Details
  • Rule ID: DOS6064
  • Code: GL_PipelineSchedule_Active_Should_Be_True
  • Platform: GitLab
  • Category: organization
  • Severity: Severitymedium
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2