gitlab-compliance 2.5.0__tar.gz → 2.6.0__tar.gz

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-compliance
-Version: 2.5.0
+Version: 2.6.0
 Summary: BDD compliance testing for GitLab CI/CD pipelines and project settings — by MaturityBuilder
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -34,7 +34,7 @@ Requires-Dist: requests (==2.34.2)
 Requires-Dist: rich (==15.0.0)
 Requires-Dist: semver (==3.0.4)
 Requires-Dist: typer (==0.27.0)
-Requires-Dist: urllib3 (==2.7.0)
+Requires-Dist: urllib3 (==2.8.0)
 Project-URL: Documentation, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Home Page, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Repository, https://github.com/MaturityBuilder/gitlab-compliance

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitlab-compliance"
-version = "2.5.0"
+version = "2.6.0"
 dynamic = [ "readme" ]
 license = "Apache-2.0"
 requires-python = ">=3.12"
@@ -42,7 +42,7 @@ pytablewriter = "1.2.1"
 oyaml = "*"
 typer = "0.27.0"
 markdown-analysis = "0.1.5"
-urllib3 = "2.7.0"
+urllib3 = "2.8.0"
 jq = "1.12.0"
 click = "^8.1.8"
 semver = "3.0.4"
@@ -62,6 +62,8 @@ gitlab-compliance = 'src.gitlab_compliance:gitlab_compliance'
 [tool.poetry.group.dev.dependencies]
 setuptools = "83.0.0"
 pytest = "^9.0.3"
+pytest-xdist = "^3.8.0"
+pytest-cov = "^6.2.1"
 pre-commit = "^4.6.1"
 pyyaml = "^6.0.3"
 coverage = "^7.9.2"

gitlab_compliance-2.6.0/src/compliance/builtin_policies/baseline-jobs.feature

@@ -0,0 +1,45 @@
+# METADATA
+# title: Baseline job controls
+# description: Core job image and execution rules bundled with gitlab-compliance.
+# custom:
+#   id: GLCI-BUILTIN-BASELINE
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+Feature: Baseline job controls
+
+# METADATA
+# title: Job images must not use the latest tag
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+  Scenario: Job images must not use the latest tag
+    Given I have any job defined
+    When it has image
+    Then its image must not match ":latest$"
+
+# METADATA
+# title: Non-template jobs must define rules
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-1
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.32
+  Scenario: Non-template jobs must define rules
+    Given I have any job defined
+    When its name does not start with "."
+    Then it must contain rules

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/component-inputs.feature

@@ -2,10 +2,27 @@
 # title: Component input constraints
 # description: Advanced Scenario Outline for component inputs and conditional fields.
 # custom:
-#   id: GLCI-BUILTIN-COMPONENT-INPUTS
+#   id: GLCI-BUILTIN-COMPONENT
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
 Feature: Component input constraints
 
+# METADATA
+# title: Component input mode constrains dependent fields
+# custom:
+#   id: GLCI-BUILTIN-COMPONENT-01
+#   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario Outline: Component input mode constrains dependent fields
     Given I have include type "component" defined
     When the entity input <input> equals <value>

gitlab_compliance-2.6.0/src/compliance/builtin_policies/include-pinning.feature

@@ -0,0 +1,46 @@
+# METADATA
+# title: Include pinning essentials
+# description: Baseline checks for component and fragment version pinning.
+# custom:
+#   id: GLCI-BUILTIN-INCPIN
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+Feature: Include pinning essentials
+
+# METADATA
+# title: Component includes must not track a branch
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must not track a branch
+    Given I have include type "component" defined
+    Then its version must not match "^(main|master|develop)$"
+
+# METADATA
+# title: Component includes must use semver
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must use semver
+    Given I have include type "component" defined
+    Then its version must match "^\\d+\\.\\d+\\.\\d+(-[\\w.]+)?$"

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-ci-conventions.feature

@@ -2,15 +2,24 @@
 # title: GitLab CI script conventions
 # description: CI-specific hygiene for curl and deprecated variables.
 # custom:
-#   id: GLCI-SHELL-CI
+#   id: GLCI-BUILTIN-SHELL-CI
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.28
 Feature: GitLab CI script conventions
 
 # METADATA
 # title: curl uses fail flag
 # custom:
-#   id: GLCI-SHELL-CI-001
+#   id: GLCI-BUILTIN-SHELL-CI-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: curl must use fail flag
     Given I have any job with effective script defined
     Then curl must use fail flag
@@ -18,8 +27,13 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: Deprecated CI_BUILD variables are not used
 # custom:
-#   id: GLCI-SHELL-CI-002
+#   id: GLCI-BUILTIN-SHELL-CI-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario: Deprecated CI_BUILD variables must not be used
     Given I have any job with effective script defined
     Then deprecated CI_BUILD variables must not be used
@@ -27,8 +41,12 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: CI variables should be quoted
 # custom:
-#   id: GLCI-SHELL-CI-003
+#   id: GLCI-BUILTIN-SHELL-CI-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: CI variables should be quoted
     Given I have any job with effective script defined
     Then user supplied variables must be quoted or validated

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-command-substitution.feature

@@ -2,15 +2,23 @@
 # title: Command substitution standards
 # description: Prefer modern dollar-parentheses substitution over backticks.
 # custom:
-#   id: GLCI-SHELL-SUB
+#   id: GLCI-BUILTIN-SHELL-SUB
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Command substitution
 
 # METADATA
 # title: Legacy backticks are not used
 # custom:
-#   id: GLCI-SHELL-SUB-001
+#   id: GLCI-BUILTIN-SHELL-SUB-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Legacy backticks are not used
     Given I have any job with effective script defined
     Then command substitution must use dollar parentheses
@@ -18,8 +26,12 @@ Feature: Command substitution
 # METADATA
 # title: Nested command substitution is readable
 # custom:
-#   id: GLCI-SHELL-SUB-002
+#   id: GLCI-BUILTIN-SHELL-SUB-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Nested command substitution is readable
     Given I have any job with effective script defined
     Then nested command substitution must use dollar parentheses

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-conditionals.feature

@@ -2,15 +2,23 @@
 # title: Conditional expression standards
 # description: Portable and safely quoted test expressions.
 # custom:
-#   id: GLCI-SHELL-TEST
+#   id: GLCI-BUILTIN-SHELL-TEST
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Conditional expressions
 
 # METADATA
 # title: Test operators are portable
 # custom:
-#   id: GLCI-SHELL-TEST-001
+#   id: GLCI-BUILTIN-SHELL-TEST-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Test operators are portable
     Given I have any job with effective script defined
     Then POSIX compliant operators must be used
@@ -18,8 +26,12 @@ Feature: Conditional expressions
 # METADATA
 # title: Variables are quoted in test statements
 # custom:
-#   id: GLCI-SHELL-TEST-002
+#   id: GLCI-BUILTIN-SHELL-TEST-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Variables are quoted in test statements
     Given I have any job with effective script defined
     Then variables in test expressions must be quoted

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-error-handling.feature

@@ -2,15 +2,24 @@
 # title: Error handling
 # description: Strict mode and exit-code handling for GitLab CI job scripts.
 # custom:
-#   id: GLCI-SHELL-ERR
+#   id: GLCI-BUILTIN-SHELL-ERR
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
 Feature: Error handling
 
 # METADATA
 # title: Scripts use strict mode
 # custom:
-#   id: GLCI-SHELL-ERR-001
+#   id: GLCI-BUILTIN-SHELL-ERR-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Multi-line scripts use strict mode
     Given I have any job with effective script defined
     When the effective script has more than 1 line
@@ -19,8 +28,12 @@ Feature: Error handling
 # METADATA
 # title: Commands return meaningful exit codes
 # custom:
-#   id: GLCI-SHELL-ERR-002
+#   id: GLCI-BUILTIN-SHELL-ERR-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Commands return meaningful exit codes
     Given I have any job with effective script defined
     Then failure must be handled explicitly
@@ -28,8 +41,12 @@ Feature: Error handling
 # METADATA
 # title: Functions propagate failures
 # custom:
-#   id: GLCI-SHELL-ERR-003
+#   id: GLCI-BUILTIN-SHELL-ERR-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Functions propagate failures
     Given I have any job with effective script defined
     Then functions must propagate failures

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-file-operations.feature

@@ -2,15 +2,23 @@
 # title: Safe file operations
 # description: Quoted paths, secure temps, and protected recursive rm.
 # custom:
-#   id: GLCI-SHELL-FILE
+#   id: GLCI-BUILTIN-SHELL-FILE
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Safe file operations
 
 # METADATA
 # title: File paths are quoted
 # custom:
-#   id: GLCI-SHELL-FILE-001
+#   id: GLCI-BUILTIN-SHELL-FILE-01
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: File paths are quoted
     Given I have any job with effective script defined
     Then file paths must be quoted
@@ -18,8 +26,12 @@ Feature: Safe file operations
 # METADATA
 # title: Temporary files are securely created
 # custom:
-#   id: GLCI-SHELL-FILE-002
+#   id: GLCI-BUILTIN-SHELL-FILE-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Temporary files are securely created
     Given I have any job with effective script defined
     When temporary files are required
@@ -28,8 +40,12 @@ Feature: Safe file operations
 # METADATA
 # title: Dangerous rm operations are protected
 # custom:
-#   id: GLCI-SHELL-FILE-003
+#   id: GLCI-BUILTIN-SHELL-FILE-03
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Dangerous rm operations are protected
     Given I have any job with effective script defined
     When rm is used recursively

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-pinning.feature

@@ -2,15 +2,27 @@
 # title: CI script dependency pinning
 # description: Supply-chain pinning controls for packages and downloads in CI scripts.
 # custom:
-#   id: GLCI-SHELL-PIN
+#   id: GLCI-BUILTIN-SHELL-PIN
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
 Feature: CI script dependency pinning
 
 # METADATA
 # title: Downloads must verify checksums
 # custom:
-#   id: GLCI-SHELL-PIN-001
+#   id: GLCI-BUILTIN-SHELL-PIN-01
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: Script downloads must verify checksums
     Given I have any job with effective script defined
     Then script downloads must verify checksums
@@ -18,8 +30,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: Disallow remote pipe to shell
 # custom:
-#   id: GLCI-SHELL-PIN-002
+#   id: GLCI-BUILTIN-SHELL-PIN-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-4
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
   Scenario: Scripts must not pipe remote downloads to a shell
     Given I have any job with effective script defined
     Then untrusted remote scripts must not be executed
@@ -28,8 +46,14 @@ Feature: CI script dependency pinning
 # title: pip packages must be version-pinned
 # description: Applies to both pip and pip3 install commands in job scripts.
 # custom:
-#   id: GLCI-SHELL-PIN-003
+#   id: GLCI-BUILTIN-SHELL-PIN-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: pip install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "pip" must use pinned versions
@@ -37,8 +61,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: apk packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-004
+#   id: GLCI-BUILTIN-SHELL-PIN-04
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: apk add must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "apk" must use pinned versions
@@ -46,8 +76,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: apt packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-005
+#   id: GLCI-BUILTIN-SHELL-PIN-05
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: apt-get install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "apt" must use pinned versions
@@ -55,8 +91,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: npm global packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-006
+#   id: GLCI-BUILTIN-SHELL-PIN-06
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: npm global installs must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "npm" must use pinned versions
@@ -64,8 +106,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: go install must pin versions
 # custom:
-#   id: GLCI-SHELL-PIN-007
+#   id: GLCI-BUILTIN-SHELL-PIN-07
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: go install must pin module versions
     Given I have any job with effective script defined
     Then package installs of type "go" must use pinned versions
@@ -73,8 +121,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: git clone must verify revision
 # custom:
-#   id: GLCI-SHELL-PIN-008
+#   id: GLCI-BUILTIN-SHELL-PIN-08
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: git clone must verify commit or tag
     Given I have any job with effective script defined
     Then git clone must verify commit or tag
@@ -83,8 +137,14 @@ Feature: CI script dependency pinning
 # title: docker run and pull must pin images
 # description: Script docker commands must reference an explicit tag or sha256 digest.
 # custom:
-#   id: GLCI-SHELL-PIN-009
+#   id: GLCI-BUILTIN-SHELL-PIN-09
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: docker run and pull must pin container images
     Given I have any job with effective script defined
     Then docker commands must pin container images to a tag or sha256 digest
@@ -93,8 +153,14 @@ Feature: CI script dependency pinning
 # title: yum/dnf packages must be version-pinned
 # description: Applies to yum, dnf, and microdnf install commands in job scripts.
 # custom:
-#   id: GLCI-SHELL-PIN-010
+#   id: GLCI-BUILTIN-SHELL-PIN-10
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: yum and dnf install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "yum" must use pinned versions

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-pipelines.feature

@@ -2,15 +2,23 @@
 # title: Pipeline safety
 # description: Detect pipeline failures with pipefail.
 # custom:
-#   id: GLCI-SHELL-PIPE
+#   id: GLCI-BUILTIN-SHELL-PIPE
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Pipeline safety
 
 # METADATA
 # title: Pipeline failures are detected
 # custom:
-#   id: GLCI-SHELL-PIPE-001
+#   id: GLCI-BUILTIN-SHELL-PIPE-01
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Pipeline failures are detected
     Given I have any job with effective script defined
     When a pipeline is used
@@ -19,8 +27,12 @@ Feature: Pipeline safety
 # METADATA
 # title: Exit codes are checked across pipelines
 # custom:
-#   id: GLCI-SHELL-PIPE-002
+#   id: GLCI-BUILTIN-SHELL-PIPE-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Exit codes are checked across pipelines
     Given I have any job with effective script defined
     When a pipeline is used

{gitlab_compliance-2.5.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-portability.feature

@@ -2,15 +2,24 @@
 # title: Shell portability
 # description: Shebang validity and bash versus POSIX compatibility.
 # custom:
-#   id: GLCI-SHELL-PORT
+#   id: GLCI-BUILTIN-SHELL-PORT
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
 Feature: Shell portability
 
 # METADATA
 # title: Shebang is valid when present
 # custom:
-#   id: GLCI-SHELL-PORT-001
+#   id: GLCI-BUILTIN-SHELL-PORT-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Shebang is valid when present
     Given I have any job with effective script defined
     Then shebang must be valid when present
@@ -18,8 +27,13 @@ Feature: Shell portability
 # METADATA
 # title: Bash specific features are declared
 # custom:
-#   id: GLCI-SHELL-PORT-002
+#   id: GLCI-BUILTIN-SHELL-PORT-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
   Scenario: Bash specific features are declared
     Given I have any job with effective script defined
     Then bash specific features must declare bash
@@ -27,8 +41,13 @@ Feature: Shell portability
 # METADATA
 # title: POSIX compatibility is maintained for sh
 # custom:
-#   id: GLCI-SHELL-PORT-003
+#   id: GLCI-BUILTIN-SHELL-PORT-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
   Scenario: POSIX compatibility is maintained for sh
     Given I have any job with effective script defined
     Then POSIX shebang scripts must not use bashisms