{"id":49512,"date":"2025-05-28T01:54:48","date_gmt":"2025-05-28T01:54:48","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49512"},"modified":"2026-02-21T07:28:58","modified_gmt":"2026-02-21T07:28:58","slug":"gitlab-pipeline-enforce-compliance-in-pipeline-code","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/gitlab-pipeline-enforce-compliance-in-pipeline-code\/","title":{"rendered":"Gitlab Pipeline – Enforce Compliance in pipeline code"},"content":{"rendered":"\n

here’s the fully updated and GitLab 18.x Cloud\u2013compliant<\/strong> answer to your original question:<\/p>\n\n\n\n

\n\n\n\n

\u2705 Enforcing Pipeline Standards with Limited Flexibility in GitLab 18.x Cloud (2026)<\/h2>\n\n\n\n

GitLab 18.x provides modern, centralized tools<\/strong> to enforce strict CI\/CD standards while still allowing controlled customization across your projects.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udd39 1. Create Standardized CI\/CD Templates<\/strong><\/h3>\n\n\n\n

Use central CI\/CD templates<\/strong> to define reusable pipeline logic that can be included<\/strong> in other projects.<\/p>\n\n\n\n

\u2705 How:<\/h4>\n\n\n\n
    \n
  • Store templates in a central project<\/strong>, e.g., devops\/pipeline-templates<\/code><\/li>\n\n\n\n
  • Reference using include:<\/code> in .gitlab-ci.yml<\/code> of any project<\/li>\n<\/ul>\n\n\n
    include<\/span>:\n  - project: 'devops\/pipeline-templates'<\/span>\n    file: '\/secure-pipeline.yml'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    \ud83d\udd10 Tip:<\/h4>\n\n\n\n
    You can lock template jobs<\/strong> by:<\/p>\n\n\n\n
      \n
    • Using rules:<\/code> to control when they run<\/li>\n\n\n\n
    • Marking them as required via Pipeline Execution Policies<\/strong> (see below)<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n
      \ud83d\udd39 2. Implement Compliance Checks for Pipelines<\/h3>\n\n\n\n
      GitLab 18.x replaces “compliance pipelines” with Pipeline Execution Policies<\/strong> \u2014 the official and enforced way to run compliance-required jobs<\/strong>.<\/p>\n\n\n\n
      \u2705 Where:<\/h4>\n\n\n\n
        \n
      • Go to: Group \u2192 Secure \u2192 Compliance Center \u2192 Policies Tab<\/strong><\/li>\n\n\n\n
      • Click \u201cNew Policy \u2192 Pipeline\u201d<\/strong><\/li>\n<\/ul>\n\n\n\n
        \u2705 Example Policy YAML:<\/h4>\n\n\n\n
        Enforce SAST<\/strong> and Secret Detection<\/strong> on every push in all projects:<\/p>\n\n\n
        type: pipeline\nname: enforce-sast-and<\/span>-secrets\nenabled: true<\/span>\nrules:\n  - type: pipeline\n    branches:\n      include<\/span>:\n        - \"*\"<\/span>\n    project_filter:\n      include<\/span>:\n        - \"*\"<\/span>\nactions:\n  - scan: sast\n  - scan: secret_detection\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n
        You can also use:
        action: job: job_name@group\/project<\/code>
        to enforce your custom job templates<\/strong>.<\/p>\n<\/blockquote>\n\n\n\n
        \n\n\n\n
        \ud83d\udd39 3. Define Allowed Customization Options<\/strong><\/h3>\n\n\n\n
        Limit what project teams can customize by:<\/p>\n\n\n\n
        Strategy<\/th>How to Apply<\/th><\/tr><\/thead>
        \u2705 Use include:<\/code> for central logic<\/td>Forces all teams to inherit your base pipeline<\/td><\/tr>
        \u2705 Lock jobs via Execution Policies<\/td>Enforced jobs cannot be overridden<\/strong> by project maintainers<\/td><\/tr>
        \u2705 Set global variables at group level<\/td>Use Group CI\/CD variables<\/strong> to prevent secrets\/config drift<\/td><\/tr>
        \u2705 Use rules:<\/code> in templates<\/td>Control when jobs run based on branches, tags, etc.<\/td><\/tr>
        \u2705 Optional stages for teams<\/td>Let teams extend pipelines via extends:<\/code> or workflow: rules:<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Example: Central job with team-controlled overrides<\/h4>\n\n\n
        .default_security_job:\n  script: echo<\/span> \"Running standard security scan\"<\/span>\n\nsecurity_scan:\n  extends: .default_security_job\n  rules:\n    - if<\/span>: '$CI_PROJECT_NAME =~ \/internal.*\/'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        \u2705 Summary<\/h2>\n\n\n\n
        Goal<\/th>GitLab 18.x Feature<\/th><\/tr><\/thead>
        Standard templates<\/td>include:<\/code> from shared CI\/CD projects<\/td><\/tr>
        Pipeline compliance enforcement<\/td>\u2705 Pipeline Execution Policies<\/strong> (via Compliance Center)<\/td><\/tr>
        Central control with limited flexibility<\/td>rules<\/code>, extends<\/code>, group variables, protected jobs<\/td><\/tr>
        Custom job enforcement<\/td>job@group\/project<\/code> in execution policy<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n\n\n\n
        Here\u2019s your complete GitLab policy project<\/strong> setup, designed for rollout across an entire group. It includes:<\/p>\n\n\n\n
          \n
        • \u2705 A Pipeline Execution Policy<\/strong> YAML<\/li>\n\n\n\n
        • \u2705 Centralized CI template project<\/strong> (secure-ci-templates<\/code>)<\/li>\n\n\n\n
        • \u2705 Enforced security scans (SAST<\/code>, Secret Detection<\/code>)<\/li>\n\n\n\n
        • \u2705 A compliance approval check<\/li>\n\n\n\n
        • \u2705 A deploy guard to prevent unreviewed changes to main<\/code><\/li>\n<\/ul>\n\n\n\n
          Use this with:<\/p>\n\n\n\n
            \n
          1. GitLab Group \u2192 Secure \u2192 Compliance Center \u2192 Policies \u2192 New Policy<\/strong><\/li>\n\n\n\n
          2. Paste the pipeline<\/code> YAML from the top section<\/li>\n\n\n\n
          3. Reference the central project in your teams\u2019 .gitlab-ci.yml<\/code> as shown<\/li>\n<\/ol>\n\n\n\n