Rules / GL034

GL034 trigger: job without strategy:

Severity: warn
OWASP: CICD-SEC-1 – Insufficient Flow Control Mechanisms

What glsec checks

glsec flags trigger: jobs that set neither strategy: mirror nor strategy: depend. Without it, the trigger job completes immediately with success, regardless of whether the triggered child or downstream pipeline succeeds or fails. Security scans, test suites, and builds that run in child pipelines will not block the parent — deployments can proceed even when critical checks fail.

This is GitLab's default behavior. Many projects add trigger: jobs without realising that a strategy: is required for the gate to be meaningful.

GitLab 18.2 added strategy: mirror, which mirrors the downstream status exactly, and now marks depend as "not recommended, use mirror instead". Both values satisfy this rule; use depend only on GitLab versions before 18.2.

Trigger example

run-security-scan:
  stage: test
  trigger:
    include:
      - local: .gitlab/ci/security.gitlab-ci.yml
    # no strategy: — scan failures are silently ignored

Safe alternative

run-security-scan:
  stage: test
  trigger:
    include:
      - local: .gitlab/ci/security.gitlab-ci.yml
    strategy: mirror   # parent waits and mirrors child pipeline status (GitLab 18.2+; depend before)

References

• GitLab docs: trigger:strategy
• GitLab docs: Downstream pipelines — trigger strategy
• GL008: allow_failure: true on a security scan job
• GL010: trigger: forward: pipeline_variables: true leaks secrets downstream

Documentation for glsec 1.23.0. Source of this page · Rule implementation