Rules / GL089

GL089 Renovate autodiscovery without a filter

Severity: warn
OWASP: CICD-SEC-5 – Insufficient PBAC (Pipeline-Based Access Controls)
CWE: CWE-284 – Improper Access Control

Risk

With autodiscovery, Renovate works on every repository its token can reach instead of a fixed list. A bot token usually has wide access, so adding the bot to a project, or any project the token happens to see, is enough to have it cloned, its configuration read and merge requests opened with the bot's permissions. Renovate's documentation recommends limiting autodiscovery with a filter.

What glsec checks

A job that runs the Renovate CLI (renovate, also through npx/bunx/pnpm dlx, a path, or after VAR=value assignments) with autodiscovery on:

--autodiscover or --autodiscover=true on the command line, or
RENOVATE_AUTODISCOVER: "true" in a variables: block that reaches the job: its own, a rules: entry, a job it extends: in the same file, or top-level, default: and workflow:rules unless inherit: variables: false.

It is reported when nothing limits the repositories: none of --autodiscover-filter, --autodiscover-namespaces, --autodiscover-topics, --autodiscover-projects on the command line, and none of RENOVATE_AUTODISCOVER_FILTER, RENOVATE_AUTODISCOVER_NAMESPACES, RENOVATE_AUTODISCOVER_TOPICS, RENOVATE_AUTODISCOVER_PROJECTS in those blocks. --autodiscover=false on the command line wins over the variable, as in Renovate.

Hidden jobs (.renovate) don't run and are not reported themselves; a job that extends one is checked with the template's script and variables.

Trigger example

renovate:
  image: renovate/renovate:39.42.4
  variables:
    RENOVATE_AUTODISCOVER: "true"
  script:
    - renovate --platform=gitlab

Safe alternative

renovate:
  image: renovate/renovate:39.42.4
  variables:
    RENOVATE_AUTODISCOVER: "true"
    RENOVATE_AUTODISCOVER_FILTER: "my-group/*"
  script:
    - renovate --platform=gitlab

Or list the repositories explicitly (renovate my-group/app my-group/lib) and leave autodiscovery off. Give the bot token access only to the projects it should process.

Not detectable

A filter set in a Renovate configuration file (config.js, RENOVATE_CONFIG_FILE) or as a CI/CD variable in the project settings is outside the pipeline file. In that case the finding can be suppressed with a reason:

    - renovate  # glsec:ignore GL089 -- autodiscoverFilter is set in config.js

Documentation for glsec 1.24.0. Source of this page · Rule implementation