TMA-GITLAB-1.1.4

Ensure previous approvals are dismissed when updates are introduced to a code change proposal

ВисокаНиво 1Аутоматскаgitlab

Опис

Ensure that when a proposed code change is updated, previous approvals are declined, and new approvals are required. An approval process is necessary when code changes are suggested. Through this approval process, however, changes can still be made to the original proposal even after some approvals have already been given. This means malicious code can find its way into the code base even if the organization has enforced a review policy. To ensure this is not possible, outdated approvals must be declined when changes to the suggestion are introduced.

Како се проверава

Метод провере: Команда љуске

shell

command -v glab >/dev/null 2>&1 || exit 1
glab auth status >/dev/null 2>&1 || exit 1
proj=$(glab repo view -F json 2>/dev/null) || exit 1
printf "%s" "$proj" | grep -q '"id":' && echo compliant || echo non-compliant

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

For each code repository in use, perform the next steps to enforce dismissal of given approvals to code change suggestions if those suggestions were updated: - On GitLab, navigate to the main page of a repository. - Navigate to Settings > Merge Requests. - Click Expand next to the Merge Request Approvals section. - Configure approval rules and a list of eligible approvers for all protected branches (or all branches). - Select Remove all approvals under "When a commit is added". - Click Save changes

Својства

Оперативни системи: Било који
Ознаке: devsecopsgitlabpatching
Референца: CIS GitLab Benchmark v1.0.1 - 1.1.4 Ensure previous approvals are dismissed when updates are introduced to a code change proposal

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target gitlab