Rules / GL037

GL037 trigger: job without inherit: variables: false

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags trigger: jobs that lack inherit: variables: false when the pipeline has top-level variables: with secret-like names (same suffix heuristic as GL006/GL027: _TOKEN, _SECRET, _PASSWORD, _KEY, etc.). By default, GitLab forwards all top-level pipeline variables to downstream pipelines — the downstream project receives secrets it was never explicitly granted.

The finding is suppressed when:

• No top-level variables with secret-like names exist, or
• inherit: variables: false is set on the trigger job

Trigger example

variables:
  DEPLOY_TOKEN: $DEPLOY_TOKEN   # top-level — forwarded to all trigger: jobs by default

deploy-to-k8s:
  trigger:
    project: myorg/k8s-deployer
    branch: main
    # inherit: variables: false absent — DEPLOY_TOKEN forwarded implicitly

Safe alternative

deploy-to-k8s:
  trigger:
    project: myorg/k8s-deployer
    branch: main
  inherit:
    variables: false   # opt out of implicit forwarding
  variables:
    DEPLOY_ENV: production   # pass only what the downstream actually needs

References

• GitLab docs: inherit:variables
• GL010: trigger: forward: pipeline_variables: true explicitly enables secret forwarding
• GL034: trigger: job without strategy: mirror / depend

Documentation for glsec 1.23.0. Source of this page · Rule implementation