Ensure each pipeline has a single responsibility

RendahLevel 2Tinjauan manualgithub

Deskripsi

Ensure each pipeline has a single responsibility in the build process. Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase ... Reported as a manual review item: no reliable read-only gh api check exists for this control.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

For each pipeline, ensure it has only one responsibility in the build process. Expected state: Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.

Properti

Sistem operasi: Apa saja
Tag: githubbuild-pipelines
Referensi: CIS GitHub Benchmark v1.2.0 - 2.1.1 Ensure each pipeline has a single responsibility