Skip to content

Audit rules reference

This is the reference for every rule chant audit can report. Each finding in a report links to its rule here.

Each rule is tagged with its tiermerge-worthy (a security or correctness issue worth a PR) or report-only (hygiene) — and its fix kinddeterministic (a safe mechanical fix the report can apply as a diff) or guidance (needs a judgement call).

Also applied to Forgejo workflows, which are GitHub-dialect.

Duplicate workflow name — report-only · guidance

Give each workflow a unique name:.

Empty matrix dimension — merge-worthy · guidance

Remove the empty matrix axis or give it values; an empty axis produces zero jobs.

needs references a non-existent job — merge-worthy · guidance

Fix the needs: target to name a real job.

Missing job permissions on a sensitive trigger — merge-worthy · guidance

Add an explicit least-privilege permissions: block to jobs under pull_request_target/workflow_dispatch.

Authority: OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication

No explicit permissions block — merge-worthy · deterministic

Add a top-level permissions: { contents: read } and widen only where a job needs it.

Authority: OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication

pull_request_target checks out untrusted code — merge-worthy · guidance

Don’t check out / run PR head code under pull_request_target; split into a privileged + unprivileged workflow.

Authority: GitHub Security Lab — Preventing pwn requests

Circular needs chain — merge-worthy · guidance

Break the cycle in the job dependency graph.

actions/checkout not pinned to a SHA — merge-worthy · deterministic

Pin actions/checkout to a full 40-char commit SHA.

Authority: OSSF Scorecard — Pinned-Dependencies · GitHub — Using third-party actions

Job without timeout-minutes — report-only · guidance

Add timeout-minutes: to bound runaway jobs.

Deprecated ::set-output — report-only · guidance

Replace ::set-output with $GITHUB_OUTPUT.

Missing concurrency block — report-only · guidance

Add a concurrency: group to deploy workflows.

Unrestricted pull_request_target — merge-worthy · guidance

Gate pull_request_target jobs and avoid running untrusted code with elevated scope.

Authority: GitHub Security Lab — Preventing pwn requests

Secret used without environment protection — report-only · guidance

Move secret-consuming jobs behind a protected environment:.

Cleanup step without if: always() — report-only · guidance

Add if: always() to cleanup steps.

Workflow with no triggers — merge-worthy · guidance

Add an on: trigger; the workflow never runs without one.

Action not pinned to a commit SHA — merge-worthy · deterministic

Pin the action to a full commit SHA instead of a tag/branch.

Authority: OSSF Scorecard — Pinned-Dependencies · GitHub — Using third-party actions

Container image not pinned to a digest — merge-worthy · deterministic

Pin the image to an immutable @sha256: digest.

Authority: OSSF Scorecard — Pinned-Dependencies

Possible action impersonation — merge-worthy · guidance

Verify the action owner/slug; it resembles a well-known action.

Authority: OSSF Scorecard — Pinned-Dependencies

Archived/abandoned or vulnerable action — merge-worthy · guidance

Replace the archived action or one with a disclosed security issue.

Blanket write-all permissions — merge-worthy · deterministic

Replace write-all with the specific scopes the jobs need (default contents: read).

Authority: OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication

Write permissions granted workflow-wide — merge-worthy · guidance

Move write scopes to the single job that needs them; keep the workflow least-privilege.

Authority: OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication

Elevated token on an untrusted-code trigger — merge-worthy · guidance

Drop the elevated permissions: on triggers that can run untrusted code.

Authority: GitHub Security Lab — Preventing pwn requests · OSSF Scorecard — Token-Permissions

Untrusted input interpolated into run: — merge-worthy · guidance

Pass untrusted ${{ }} values via an env: var and reference "$VAR", never inline in the script.

Authority: GitHub — Understanding the risk of script injections

Untrusted input written to GITHUB_ENV/GITHUB_PATH — merge-worthy · guidance

Don’t write untrusted input to $GITHUB_ENV/$GITHUB_PATH; sanitize or avoid.

Authority: GitHub — Understanding the risk of script injections

workflow_run checks out untrusted code in a privileged context — merge-worthy · guidance

Avoid checking out untrusted code under workflow_run; treat it as privileged.

Authority: GitHub Security Lab — Preventing pwn requests

Auth gate on a spoofable author field — merge-worthy · guidance

Gate on a non-spoofable identity, not a commit-author field.

Authority: GitHub Security Lab — Preventing pwn requests

Self-hosted runner on an untrusted-code trigger — merge-worthy · guidance

Don’t run untrusted-code triggers on self-hosted runners.

Authority: GitHub Security Lab — Preventing pwn requests

Blanket secrets: inherit — merge-worthy · guidance

Pass only the specific secrets the reusable workflow needs.

Authority: GitHub — Using secrets in GitHub Actions

Entire secrets context passed — merge-worthy · guidance

Pass named secrets instead of the whole secrets context.

Authority: GitHub — Using secrets in GitHub Actions

Secret consumed without an environment gate — merge-worthy · guidance

Put secret-consuming jobs behind a protected environment.

Authority: GitHub — Using secrets in GitHub Actions

Hardcoded registry/container credential — merge-worthy · guidance

Remove the hardcoded credential, move it to a secret, and rotate it (responsible disclosure first).

Authority: GitHub — Using secrets in GitHub Actions

Secret interpolated into run: — merge-worthy · guidance

Reference secrets via env:, not inline in the shell command.

Authority: GitHub — Understanding the risk of script injections · GitHub — Using secrets in GitHub Actions

Constant/unsound guard condition — merge-worthy · guidance

Fix the always-true/false if: — it may neutralize a security gate.

Ineffective contains() guard (reversed args) — merge-worthy · guidance

Swap the contains() arguments so the guard actually filters.

Obfuscated guard condition — merge-worthy · guidance

Simplify the indirect if: so its effect is reviewable.

Persisted checkout credentials reachable by an artifact — merge-worthy · guidance

Use persist-credentials: false or exclude .git from uploaded artifacts.

Authority: GitHub — Using secrets in GitHub Actions

Cache populated in a privileged context — merge-worthy · guidance

Don’t populate caches from untrusted code paths (poisoning risk).

Authority: GitHub Security Lab — Preventing pwn requests

Long-lived token instead of OIDC — report-only · guidance

Migrate publish/release to OIDC short-lived credentials.

Software piped to a shell without verification — merge-worthy · guidance

Verify a checksum/signature before executing fetched scripts.

Authority: OSSF Scorecard — Pinned-Dependencies

Re-enables unsafe set-env/add-path — merge-worthy · guidance

Remove ACTIONS_ALLOW_UNSECURE_COMMANDS; use $GITHUB_ENV/$GITHUB_PATH.

Authority: GitHub — Understanding the risk of script injections

Feature with a known security footgun — merge-worthy · guidance

Replace the flagged feature with the safe alternative.

Runtime install of a tool already on the runner — report-only · guidance

Drop the redundant install to save time.

Workflow without a name — report-only · guidance

Add a name: to the workflow.

Dependency update can execute untrusted code — merge-worthy · guidance

Disable the option that lets dependency updates run external code.

Authority: GitHub Security Lab — Preventing pwn requests

Dependency update has no cooldown window — report-only · guidance

Add a cooldown so new releases aren’t merged instantly.

Job references an undefined stage — merge-worthy · guidance

Add the stage to stages: or fix the job’s stage:.

Job rules always evaluate to never — merge-worthy · guidance

Fix the rules: so the job can run; it is currently unreachable.

Deprecated property — report-only · guidance

Replace the deprecated GitLab CI property.

Invalid needs target — merge-worthy · guidance

Fix the dangling/self needs: reference.

Invalid extends target — merge-worthy · guidance

Point extends: at a template that exists in the pipeline.

Circular needs chain — merge-worthy · guidance

Break the cycle in the job dependency graph.

Hardcoded secret in variables — merge-worthy · guidance

Move the secret out of variables: into a masked/protected CI variable and rotate it.

Authority: GitHub — Using secrets in GitHub Actions

Insecure (non-HTTPS) registry — merge-worthy · guidance

Use an HTTPS registry endpoint.

Missing job timeout — report-only · guidance

Add a timeout: to bound long-running jobs.

Missing retry on deploy job — report-only · guidance

Add a retry: strategy to deploy jobs.

Duplicate job names — merge-worthy · guidance

Rename so each job resolves to a unique name.

Unused global variable — report-only · guidance

Remove the unused global variables: entry.

Missing artifacts expiry — report-only · guidance

Add expire_in: to artifacts to avoid disk bloat.

Overly broad rules (when: always) — report-only · guidance

Add real conditions to the job’s rules:.

Manual job without allow_failure — report-only · guidance

Add allow_failure: true so a manual job doesn’t block the pipeline.

Cache without a key — report-only · guidance

Add a cache.key to avoid cross-job cache collisions.

Privileged DinD service without TLS — merge-worthy · guidance

Set DOCKER_TLS_CERTDIR for privileged Docker-in-Docker services.

Empty script — merge-worthy · guidance

Give the job a non-empty script:; it currently does nothing.

Redundant needs — report-only · guidance

Drop needs: already implied by stage ordering.

include/component resolved by a moving ref — merge-worthy · guidance

Pin include:project/component to a tag or commit SHA, not a branch.

Authority: OSSF Scorecard — Pinned-Dependencies

Insecure or mutable include:remote — merge-worthy · guidance

Use HTTPS and pin the remote include to an immutable ref.

Authority: OSSF Scorecard — Pinned-Dependencies

Container image not pinned to a digest — merge-worthy · deterministic

Pin the image to an immutable @sha256: digest.

Authority: OSSF Scorecard — Pinned-Dependencies

Possible include/component impersonation — merge-worthy · guidance

Verify the include source; it resembles a well-known project.

Authority: OSSF Scorecard — Pinned-Dependencies

OIDC id_token without a scoped audience — merge-worthy · guidance

Set a specific aud: on the OIDC id_token.

Authority: GitHub — Security hardening with OpenID Connect

OIDC id_token mintable from a merge-request pipeline — merge-worthy · guidance

Restrict OIDC token minting to protected pipelines.

Authority: GitHub — Security hardening with OpenID Connect · GitHub Security Lab — Preventing pwn requests

Untrusted CI variable interpolated into a script — merge-worthy · guidance

Pass untrusted variables via the environment and quote them; don’t inline.

Authority: GitHub — Understanding the risk of script injections

Privileged service reachable from merge-request pipelines — merge-worthy · guidance

Block privileged/DinD services on merge-request pipelines.

Authority: GitHub Security Lab — Preventing pwn requests

Security gate on an untrusted ref regex — merge-worthy · guidance

Don’t gate security decisions on a regex over an untrusted ref variable.

Authority: GitHub Security Lab — Preventing pwn requests

Secret reachable from a merge-request pipeline — merge-worthy · guidance

Scope secret-like variables to protected branches/pipelines.

Authority: GitHub — Using secrets in GitHub Actions · GitHub Security Lab — Preventing pwn requests

Secret printed to job logs — merge-worthy · guidance

Stop echoing the secret-like variable; mask it.

Authority: GitHub — Using secrets in GitHub Actions

Hardcoded credential in a registry login — merge-worthy · guidance

Move the credential to a masked CI variable and rotate it.

Authority: GitHub — Using secrets in GitHub Actions

Tautological rules:if condition — merge-worthy · guidance

Fix the always-true rules:if; it may neutralize a gate.

Unreachable rules after an unconditional match — report-only · guidance

Remove the dead rules: entries after the catch-all.

Match-anything regex gate in rules:if — merge-worthy · guidance

Tighten the regex; a match-anything gate is no gate.

Authority: GitHub Security Lab — Preventing pwn requests

Public artifacts expose build output — merge-worthy · guidance

Mark sensitive artifacts non-public (public: false).

Artifact path may capture a credential file — merge-worthy · guidance

Narrow the artifact path so it can’t capture credential files.

Authority: GitHub — Using secrets in GitHub Actions

Cache populated in a merge-request pipeline — merge-worthy · guidance

Don’t populate caches from merge-request pipelines (poisoning risk).

Authority: GitHub Security Lab — Preventing pwn requests

Software piped to a shell without verification — merge-worthy · guidance

Verify a checksum/signature before executing fetched scripts.

Authority: OSSF Scorecard — Pinned-Dependencies

Pipeline without workflow:name — report-only · guidance

Add a workflow:name for clearer pipeline naming.

Unresolved action reference on Forgejo — merge-worthy · guidance

Use an action reference Forgejo can resolve (full URL or a mirrored action).

GitHub-hosted runner label with no Forgejo equivalent — merge-worthy · guidance

Use a runner label your Forgejo instance provides.

Run against Kubernetes manifests.

Argo Application references an undeclared AppProject — merge-worthy · guidance

Declare the named AppProject or reference an existing project.

Argo Application targets an unregistered cluster — merge-worthy · guidance

Point spec.destination at a registered cluster or the in-cluster target.

Argo source.path may not resolve — report-only · guidance

Ensure the source path exists under the build root.

Hardcoded secret in env var — merge-worthy · guidance

Use a secretKeyRef instead of a literal value, and rotate the secret.

Authority: Kubernetes — Good practices for Secrets

Image uses :latest or no tag — merge-worthy · guidance

Pin the image to an explicit version tag (ideally a digest).

Authority: OSSF Scorecard — Pinned-Dependencies

Hardcoded API key in env var — merge-worthy · guidance

Move the key to a Secret and rotate it.

Authority: Kubernetes — Good practices for Secrets

Private key stored in a ConfigMap — merge-worthy · guidance

Store private keys in a Secret, not a ConfigMap.

Authority: Kubernetes — Good practices for Secrets

Deployment selector does not match template labels — merge-worthy · guidance

Align spec.selector with the pod template labels.

Resource missing metadata labels — report-only · guidance

Add metadata labels for filtering and tooling.

Container missing name — merge-worthy · guidance

Add the required container name.

Container ports not named — report-only · guidance

Name ports for clearer Service/NetworkPolicy config.

imagePullPolicy not explicit — report-only · guidance

Set imagePullPolicy explicitly to avoid surprising defaults.

Container missing resource limits — report-only · guidance

Set CPU and memory limits.

Privileged container — merge-worthy · guidance

Remove privileged: true; grant only the specific capabilities needed.

Authority: Kubernetes — Pod Security Standards

Root filesystem is writable — merge-worthy · guidance

Set readOnlyRootFilesystem: true.

Authority: Kubernetes — Pod Security Standards

Container may run as root — merge-worthy · guidance

Set runAsNonRoot: true (and a non-zero runAsUser).

Authority: Kubernetes — Pod Security Standards

Capabilities not dropped — merge-worthy · guidance

drop: [ALL] and add back only what is required.

Authority: Kubernetes — Pod Security Standards

Pod uses host network — merge-worthy · guidance

Remove hostNetwork; it bypasses network isolation.

Authority: Kubernetes — Pod Security Standards

Pod shares host PID namespace — merge-worthy · guidance

Remove hostPID.

Authority: Kubernetes — Pod Security Standards

Pod shares host IPC namespace — merge-worthy · guidance

Remove hostIPC.

Authority: Kubernetes — Pod Security Standards

Container missing probes — report-only · guidance

Add liveness and readiness probes.

Deployment has a single replica — report-only · guidance

Use replicas >= 2 for availability.

No PodDisruptionBudget for an HA Deployment — report-only · guidance

Add a PDB to protect availability during disruptions.

SSL redirect without a certificate — report-only · guidance

Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation.

Ingress backend port does not match the Service — merge-worthy · guidance

Point the Ingress backend at a declared Service port.

Container command starts with a flag — merge-worthy · guidance

The first command element should be a binary, not a flag.

shmSize exceeds the container memory limit — merge-worthy · guidance

Lower shmSize or raise the memory limit so the pod can schedule.

RayCluster missing spec.rayVersion — report-only · guidance

Set spec.rayVersion so KubeRay picks the right autoscaler image.

rayVersion does not match the head image tag — report-only · guidance

Align spec.rayVersion with the Ray version in the head container image.

Run against Dockerfiles and Compose files.

Service uses :latest or untagged image — merge-worthy · guidance

Pin the image to an explicit version tag (ideally a digest).

Authority: OSSF Scorecard — Pinned-Dependencies

Named volume declared but unused — report-only · guidance

Remove the unused volume or mount it in a service.

Service exposes SSH (port 22) — merge-worthy · guidance

Don’t expose SSH from a container; use exec/ephemeral access instead.

Authority: Docker — Security best practices

apt-get install without —no-install-recommends — report-only · guidance

Add —no-install-recommends to keep images small.

ADD used where COPY would do — report-only · guidance

Prefer COPY unless fetching a URL or extracting an archive.

No USER instruction — container runs as root — merge-worthy · guidance

Add a non-root USER instruction.

Authority: Docker — Security best practices

Run against CloudFormation templates (JSON or YAML).

Circular resource dependency — merge-worthy · guidance

Break the dependency cycle between resources.

Extension constraint violation — merge-worthy · guidance

Fix the cross-property constraint flagged by the cfn-lint extension schema.

Redundant DependsOn — report-only · guidance

Remove DependsOn already implied by a Ref/GetAtt.

Deprecated Lambda runtime — report-only · guidance

Upgrade to a supported Lambda runtime.

Child stack exports nothing — merge-worthy · guidance

Add stackOutput() exports the parent can reference.

Nested stack outputs never referenced — report-only · guidance

Reference the outputs or split into a separate build.

Circular dependency between nested stacks — merge-worthy · guidance

Break the cycle between nested stacks.

Deprecated property — report-only · guidance

Replace the deprecated CloudFormation property.

Missing tags on a taggable resource — report-only · guidance

Add tags for cost allocation and compliance.

S3 bucket missing public access block — merge-worthy · guidance

Add a PublicAccessBlockConfiguration blocking all public access.

Authority: AWS — Security Pillar (Well-Architected)

Security group allows unrestricted ingress on a sensitive port — merge-worthy · guidance

Restrict the CIDR on SSH/RDP/database ports to known sources.

Authority: AWS — Security Pillar (Well-Architected)

IAM policy uses a wildcard Action — merge-worthy · guidance

Scope the policy to specific actions (least privilege).

Authority: AWS — Security Pillar (Well-Architected)

RDS storage not encrypted — merge-worthy · guidance

Enable StorageEncrypted for encryption at rest.

Authority: AWS — Security Pillar (Well-Architected)

Lambda has no VpcConfig — report-only · guidance

Consider a VpcConfig for network isolation if the function needs VPC resources.

CloudFront has no WAF web ACL — report-only · guidance

Consider attaching a WAF web ACL.

ALB access logging disabled — report-only · guidance

Enable access logging for audit trails.

SNS topic not encrypted — merge-worthy · guidance

Set KmsMasterKeyId for encryption at rest.

Authority: AWS — Security Pillar (Well-Architected)

SQS queue not encrypted — merge-worthy · guidance

Enable SqsManagedSseEnabled or set KmsMasterKeyId.

Authority: AWS — Security Pillar (Well-Architected)

DynamoDB point-in-time recovery disabled — report-only · guidance

Enable PITR for recovery.

EBS volume not encrypted — merge-worthy · guidance

Enable encryption at rest.

Authority: AWS — Security Pillar (Well-Architected)

Invalid DependsOn target — merge-worthy · guidance

Fix the dangling/self DependsOn reference.

Missing DependsOn for a known ordering pattern — report-only · guidance

Add the DependsOn the pattern requires.

EKS Addon missing ServiceAccountRoleArn — report-only · guidance

Set ServiceAccountRoleArn (IRSA) for addons that need it.

EFS transit encryption disabled on Fargate — merge-worthy · guidance

Enable transit encryption for the EFS volume.

Authority: AWS — Security Pillar (Well-Architected)

Solr heap exceeds Fargate task memory — merge-worthy · guidance

Lower SOLR_HEAP or raise task memory.

Fargate Solr task under-provisioned — report-only · guidance

Allocate >= 2048MB for the Solr task.

Solr container missing nofile ulimit — report-only · guidance

Set a nofile ulimit >= 65535.

Non-ASCII characters in resource properties — merge-worthy · guidance

Remove non-ASCII characters rejected at changeset time.

Null values in resource properties — merge-worthy · guidance

Fix the invalid AttrRef producing null property values.

Run against ARM deployment templates (JSON).

Redundant dependsOn — report-only · guidance

Remove dependsOn already implied by reference()/resourceId().

Missing or invalid apiVersion — merge-worthy · guidance

Set a valid YYYY-MM-DD apiVersion on every resource.

Deprecated API version — report-only · guidance

Move to a current apiVersion.

Resource missing location — merge-worthy · guidance

Add the required location property.

Storage account allows public blob access — merge-worthy · guidance

Set allowBlobPublicAccess to false.

Authority: Microsoft Cloud Security Benchmark

Storage account missing encryption — merge-worthy · guidance

Enable encryption services for data at rest.

Authority: Microsoft Cloud Security Benchmark

Key Vault soft-delete not enabled — report-only · guidance

Enable soft-delete.

Key Vault purge protection not enabled — report-only · guidance

Enable purge protection.

SQL Server missing auditing — report-only · guidance

Enable auditing for compliance and threat detection.

SQL database missing TDE — merge-worthy · guidance

Enable Transparent Data Encryption.

Authority: Microsoft Cloud Security Benchmark

App Service missing managed identity — report-only · guidance

Enable a system- or user-assigned identity.

App Service not HTTPS-only — merge-worthy · guidance

Set httpsOnly to true.

Authority: Microsoft Cloud Security Benchmark

App Service min TLS below 1.2 — merge-worthy · guidance

Set minTlsVersion to 1.2+.

Authority: Microsoft Cloud Security Benchmark

VM not using a managed disk — report-only · guidance

Use a managed disk.

VM missing boot diagnostics — report-only · guidance

Enable boot diagnostics.

AKS cluster missing RBAC — report-only · guidance

Enable Kubernetes RBAC.

AKS cluster missing network policy — report-only · guidance

Configure a networkPolicy.

Container Registry admin user enabled — merge-worthy · guidance

Disable the admin user; use Azure AD / service principals.

Authority: Microsoft Cloud Security Benchmark

Network interface missing NSG — report-only · guidance

Associate an NSG to control traffic.

Managed disk missing encryption — merge-worthy · guidance

Enable encryption for data at rest.

Authority: Microsoft Cloud Security Benchmark

Run against Config Connector (cnrm.cloud.google.com) manifests.

Storage/SQL without encryption configuration — merge-worthy · guidance

Configure encryption (e.g. a CMEK key) for data at rest.

Authority: Google Cloud — Security best practices

Public IAM member (allUsers/allAuthenticatedUsers) — merge-worthy · guidance

Remove allUsers/allAuthenticatedUsers bindings.

Authority: Google Cloud — Security best practices

Missing project-id annotation — report-only · guidance

Add the cnrm.cloud.google.com/project-id annotation.

Bucket without uniform bucket-level access — merge-worthy · guidance

Enable uniformBucketLevelAccess.

Authority: Google Cloud — Security best practices

Cloud SQL open to 0.0.0.0/0 — merge-worthy · guidance

Restrict authorizedNetworks to known sources.

Authority: Google Cloud — Security best practices

Missing deletion-policy annotation — report-only · guidance

Add the cnrm.cloud.google.com/deletion-policy annotation.

Bucket versioning disabled — report-only · guidance

Enable object versioning.

Cloud SQL backups disabled — report-only · guidance

Enable backup configuration.

Firewall open to 0.0.0.0/0 — merge-worthy · guidance

Restrict sourceRanges to known sources.

Authority: Google Cloud — Security best practices

KMS key without rotation — merge-worthy · guidance

Set a rotationPeriod on the CryptoKey.

Authority: Google Cloud — Security best practices

Reference to an undefined resource — merge-worthy · guidance

Point the reference at a resource in the output.

Missing or invalid apiVersion — merge-worthy · guidance

Set a valid cnrm.cloud.google.com apiVersion.

Alpha API version — report-only · guidance

Move to a beta/GA API version.

Missing managed-by label — report-only · guidance

Add the app.kubernetes.io/managed-by label.

Cluster without Workload Identity — merge-worthy · guidance

Enable Workload Identity on the ContainerCluster.

Authority: Google Cloud — Security best practices

Node pool uses broad cloud-platform scope — merge-worthy · guidance

Use narrowly-scoped OAuth scopes instead of cloud-platform.

Authority: Google Cloud — Security best practices

Compute instance without Shielded VM — report-only · guidance

Enable Shielded VM configuration.

No IAMAuditConfig found — report-only · guidance

Configure audit logging via IAMAuditConfig.

No Service (enabled APIs) found — report-only · guidance

Declare the GCP APIs you depend on.

No VPC Service Controls perimeter — report-only · guidance

Consider an AccessContextManager ServicePerimeter.

Unknown field in resource spec — merge-worthy · guidance

Remove the unknown spec field.

Missing required spec field — merge-worthy · guidance

Add the required spec field.

Spec field has wrong type/structure — merge-worthy · guidance

Fix the field’s type/structure.

Run against Helm charts (Chart.yaml + templates).

Sub-chart wrapper with no templates — report-only · guidance

Deploy the upstream chart directly instead of an empty wrapper.

Chart.yaml missing required fields — merge-worthy · guidance

Set apiVersion (v2), name, and version in Chart.yaml.

Missing values.schema.json — report-only · guidance

Add a values.schema.json to validate values.

Invalid Go template syntax — merge-worthy · guidance

Fix the unbalanced template braces.

Missing NOTES.txt — report-only · guidance

Add templates/NOTES.txt for application charts.

Missing _helpers.tpl — report-only · guidance

Add templates/_helpers.tpl.

Missing standard Helm labels — report-only · guidance

Add the recommended app.kubernetes.io labels.

Hook weights undefined — report-only · guidance

Define hook weights when multiple hooks exist.

Undocumented values — report-only · guidance

Document values via schema or comments.

Dependencies pinned, not ranged — report-only · guidance

Use semver ranges for chart dependencies.

No Helm test — report-only · guidance

Add at least one Helm test for application charts.

Container resources not set — report-only · guidance

Set limits/requests via values or defaults.

Container image uses :latest or no tag — merge-worthy · guidance

Pin the image to an explicit version tag.

Authority: OSSF Scorecard — Pinned-Dependencies

Container may run as root — merge-worthy · guidance

Set runAsNonRoot in the security context.

Authority: Kubernetes — Pod Security Standards

Root filesystem writable — merge-worthy · guidance

Set readOnlyRootFilesystem.

Authority: Kubernetes — Pod Security Standards

Privileged container — merge-worthy · guidance

Remove privileged mode.

Authority: Kubernetes — Pod Security Standards

Resource specs missing cpu/memory — report-only · guidance

Set cpu and memory in limits/requests.

CRDs in crds/ are never upgraded — report-only · guidance

Manage CRD upgrades outside Helm or via a separate chart.

Inline Secret data — merge-worthy · guidance

Use ExternalSecret/SealedSecret instead of inline Secret data.

Authority: Kubernetes — Good practices for Secrets

Unused values key — report-only · guidance

Remove values defined but never referenced.

Deprecated/invalid Kubernetes API version — merge-worthy · guidance

Update to a supported apiVersion.