Rules / GL041

GL041 include: component: without pinned version

Severity: warn
OWASP: CICD-SEC-4 – Poisoned Pipeline Execution / CICD-SEC-8 – Ungoverned Usage of 3rd-Party Services

What glsec checks

glsec flags include: component: entries that use a mutable or missing version specifier. GitLab CI components are versioned via an @<ref> suffix. When the ref is a branch name (@main), a tilde-latest (@~latest), @latest, or omitted entirely, the exact pipeline template executed can change between runs — a compromised or updated component can silently alter your pipeline's security controls.

Only the following refs are considered pinned:

• Exact semver tag: 1.0.0, v2.1.3, 2.0
• Full 40-character hex commit SHA: a3f1e9b2c4d5678901234567890abcdef1234567

Trigger example

include:
  - component: gitlab.com/components/sast           # missing @<version>
  - component: gitlab.com/components/dast@latest    # mutable alias
  - component: gitlab.com/components/fuzz@~latest   # tilde-latest — still mutable
  - component: gitlab.com/components/iast@main      # branch name — mutable

Safe alternatives

Pin to a semver tag:

include:
  - component: gitlab.com/components/sast@1.3.0
  - component: gitlab.com/components/dast@2.0.1

Pin to a commit SHA (highest integrity):

include:
  - component: gitlab.com/components/sast@a3f1e9b2c4d5678901234567890abcdef1234567

Notes

• Semver tags (1.0.0, v1.2.3) are considered pinned because they are immutable once published to the GitLab component catalog.
• Tilde-version (@~latest, @~1) is GitLab's syntax for "latest compatible version" and remains mutable across pipeline runs.
• This rule complements GL003, which flags mutable ref: values in include: project: entries. GL003 uses a denylist of known branch names; GL041 uses an allowlist approach specific to component versioning.
• Suppress false positives with: # glsec:ignore GL041 -- component version is intentionally floating.

Documentation for glsec 1.23.0. Source of this page · Rule implementation