| Field | Value |
|---|---|
| Category | CICD-SEC-3 |
| Platform | GitLab CI |
| Severity | MEDIUM |
| Auto-fix | Flags include: entries that reference a remote project or file by a mutable ref (branch/tag) instead of a pinned commit SHA. |
What the check does
A remote include resolved by a mutable ref can be rewritten upstream to inject malicious pipeline configuration — the GitLab analog of an unpinned action. Pininclude: to a commit SHA (ref: <sha>).
Why it matters
Findings for this rule fire only on.gitlab-ci.yml and .gitlab-ci/*.yml.
It is the GitLab analog of the correspondingly-numbered GitHub Actions rule; see
the rules overview for the full
GitLab table.