Component Pinning¶

CI/CD components in include: must use immutable version refs, not branch names like @main.

Bad¶

include:
  - component: gitlab.com/org/pipeline@main

Good¶

include:
  - component: gitlab.com/org/pipeline@1.2.0

Policy¶

From security/component-pinning.feature:

Scenario: Component includes must use semver
  Given I have include type "component" defined
  Then its version must match "^\d+\.\d+\.\d+(-[\w.]+)?$"

Consume in GitLab CI¶

Offline policy — no API token required:

include:
  - local: example-ci/compliance-jobs.yml

compliance:
  extends: .compliance:offline

The job runs all policies under policies/security/, including component-pinning.feature.

Run locally¶

gitlab-compliance check -f policies/security/ -p .gitlab-ci.yml

Scenarios skip when the pipeline has no component: includes (not applicable).

Back to Examples.