Ensure pipelines are automatically scanned for misconfigurations

MediaNivel 1Revisión manualgithub

Descripción

Scan the pipeline for misconfigurations. It is recommended that this be performed automatically. Automatic scans for misconfigurations detect human mistakes and misconfigured tasks. This protects the environment from backdoors caused by such mistakes, which create easier access for attackers. Reported as a manual review item: no reliable read-only gh api check exists for this control.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

For each pipeline, verify that it is automatically scanned for misconfigurations. Expected state: For each pipeline, set automated misconfiguration scanning.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

For each pipeline, set automated misconfiguration scanning.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: githubbuild-pipelines
Referencia: CIS GitHub Benchmark v1.2.0 - 2.3.6 Ensure pipelines are automatically scanned for misconfigurations