Rules / GL049

GL049 Deploy job marked interruptible: true

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-362 – Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Risk

When a deployment job is marked interruptible: true, GitLab may cancel it mid-execution if a newer pipeline starts (depending on workflow:auto_cancel settings). A deployment interrupted halfway leaves the target environment in an undefined state: database migrations may be partially applied, containers partially updated, or load-balancer state inconsistent.

interruptible: true is appropriate for build, test, and lint jobs — not for jobs that mutate external state.

What is flagged

Jobs whose name, stage, or environment: key indicates deployment activity and that have interruptible: true explicitly set. Matched keywords: deploy, release, publish, rollout, migrate, provision.

Trigger example

deploy-production:
  stage: deploy
  interruptible: true
  script:
    - kubectl apply -f k8s/
    - kubectl rollout status deployment/app

Safe alternative

Omit interruptible (default is false) or set it explicitly, and pair with resource_group: to prevent concurrent runs:

deploy-production:
  stage: deploy
  interruptible: false
  resource_group: production
  script:
    - kubectl apply -f k8s/
    - kubectl rollout status deployment/app

Notes

• Jobs without an explicit interruptible: true are not flagged (default is false)
• Non-deployment jobs with interruptible: true are not flagged — this is the intended use case
• See also: GL019 (deploy job without resource_group:)

Documentation for glsec 1.23.0. Source of this page · Rule implementation