Rules / GL019

GL019 Deploy job missing resource_group:

Severity: warn
OWASP: CICD-SEC-1 – Insufficient Flow Control Mechanisms

What glsec checks

glsec flags deployment and publish jobs that do not have a resource_group: key. Without it, multiple pipeline runs can execute the same deploy job concurrently — causing race conditions, partial deploys, overwritten state, or conflicting releases.

A job is considered a deployment/publish job if it has:

• An environment: key (any value), or
• A stage: value containing deploy, release, publish, or ship

Trigger example

deploy-prod:
  stage: deploy
  environment: production
  script:
    - ./deploy.sh
  # no resource_group: — two pipeline runs can deploy simultaneously

Safe alternative

deploy-prod:
  stage: deploy
  environment: production
  resource_group: production
  script:
    - ./deploy.sh

GitLab serialises jobs in the same resource_group — the second run waits until the first completes. Use separate group names per environment (e.g. staging, production) if you want concurrent deploys across environments but serialised deploys within each.

Why this matters

Without concurrency control, two developers merging to the same branch within seconds of each other can trigger overlapping deploys. The later deploy may start before the earlier one finishes, causing:

• Configuration to be applied out of order
• Database migrations to run twice or in the wrong sequence
• Health checks to pass against the wrong version
• Partial state visible to end users

References

• GitLab resource_group documentation
• GL017 (deploy job without runner tags: — complementary rule)

Documentation for glsec 1.23.0. Source of this page · Rule implementation