Rules / GL074

GL074 Tautological (always-true) `rules:if` condition

Severity: warn
OWASP: CICD-SEC-1 – Insufficient Flow Control Mechanisms

What glsec checks

glsec flags rules:if conditions that are provably always true. Such a condition makes the gate it guards a no-op: a job meant to run only under specific circumstances silently runs everywhere — including contexts the author intended to exclude, such as fork merge requests or scheduled pipelines. When the gated job is privileged (a deploy, a release, a job that holds secrets), the ineffective gate is a security problem, not just a logic bug.

Detected, conservatively (only expressions true regardless of any variable value):

Pattern	Example
A standalone `true` OR operand	`$CI_COMMIT_BRANCH \|\| true`, `true \|\| $X`
A constant comparison of two literals	`"true" == "true"`, `"a" != "b"`
The same variable compared `==` and `!=` to the same literal across an OR	`$CI_PIPELINE_SOURCE != "schedule" \|\| $CI_PIPELINE_SOURCE == "schedule"`

This complements GL043 (unanchored regex in rules:if) and GL039 (|| true silencing a script command). GL074 targets the gate condition itself being a tautology.

Trigger examples

deploy:
  rules:
    - if: '$CI_COMMIT_BRANCH || true'                                            # standalone true
    - if: '"true" == "true"'                                                     # constant comparison
    - if: '$CI_PIPELINE_SOURCE != "schedule" || $CI_PIPELINE_SOURCE == "schedule"'  # A || !A
  script:
    - ./deploy.sh

Safe alternative

Write a condition that actually restricts when the job runs:

deploy:
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
  script:
    - ./deploy.sh

What is not flagged

To keep false positives low, GL074 only reports conditions it can prove are always true. It deliberately does not flag:

$A || $B — an OR of two variables (false when both are empty).
$X || true && $Y — && binds tighter, so this is $X || $Y, not always true.
$V == "a" || $V != "b" — different literals; false when $V == "b".
$VAR == $OTHER — variable-to-variable comparison.

References

GitLab: rules:if
GitLab: CI/CD variable expressions
GL043: unanchored regex on a user-controlled variable in rules:if

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL074 Tautological (always-true) rules:if condition