TMA-GITHUB-2.1.1
Ensure each pipeline has a single responsibility
説明
Ensure each pipeline has a single responsibility in the build process. Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase ... Reported as a manual review item: no reliable read-only gh api check exists for this control.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
For each pipeline, ensure it has only one responsibility in the build process. Expected state: Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- githubbuild-pipelines
- 参照
- CIS GitHub Benchmark v1.2.0 - 2.1.1 Ensure each pipeline has a single responsibility