Ensure inactive branches are periodically reviewed and removed

低等級 1人工審核gitlab

說明

Keep track of code branches that are inactive for a lengthy period of time and periodically remove them. Git branches that have been inactive (i.e., no new changes introduced) for a long period of time are enlarging the surface of attack for malicious code injection, sensitive data leaks, and CI pipeline exploitation. They potentially contain outdated dependencies which may leave them highly vulnerable. They are more likely to be improperly managed, and could possibly be accessed by a large number of members of the organization.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

For each project, verify that all existing Git branches are active or have yet to be checked for inactivity by performing the next steps: - Navigate to the main page of the project. - In the sidebar select Code > Branches - Use the navigation at the top of the page to view the Stale branches. The Stale view shows all branches that no one has committed to in the last three months, ordered by the branches with the oldest commits first. - If the list is empty, you are compliant. If the list is not empty, but there is a valid reason the branches listed are not deleted, you are compliant. You can perform the next steps to verify that merge request branches are prevented from becoming stale branches by default: - Navigate to the main page of the project. - In the left sidebar select Settings > Merge requests - Verify if 'Enable "Delete source branch" option by default' is selected. If it is not selected, you are more likely to become non-compliant.

修補方式

修補方法: 操作指南或基礎設施修補檔

For each project, review existing Git branches and remove those which were identified during the audit as being non-compliant by performing the following: - Navigate to the main page of the project. - In the sidebar select Code > Branches - Next to each non-compliant branch select the vertical ellipsis - Select 'Delete branch' - Read the warning - Select 'Yes, delete branch' You can perform the next steps to reduce the likelihood of a stale branches remaining after a merge request: - Navigate to the main page of the project. - In the left sidebar select Settings > Merge requests - Select 'Enable "Delete source branch" option by default'.

屬性

作業系統: 不限
標籤: branch-protectiondevsecopsgitlab
參考資料: CIS GitLab Benchmark v1.0.1 - 1.1.8 Ensure inactive branches are periodically reviewed and removed