Ensure each pipeline has a single responsibility

낮음레벨 2수동 검토github

설명

Ensure each pipeline has a single responsibility in the build process. Build pipelines generally have access to multiple secrets depending on their purposes. There are, for example, secrets of the test environment for the test phase, repository and artifact credentials for the build phase ... Reported as a manual review item: no reliable read-only gh api check exists for this control.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For each pipeline, ensure it has only one responsibility in the build process. Expected state: Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Divide each multi-responsibility pipeline into multiple pipelines, each having a single responsibility with the least privilege. Additionally, create all new pipelines with a sole purpose going forward.

속성

운영 체제: 모두
태그: githubbuild-pipelines
참고 자료: CIS GitHub Benchmark v1.2.0 - 2.1.1 Ensure each pipeline has a single responsibility