gitlab-compliance 2.5.0__tar.gz → 2.7.0__tar.gz

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-compliance
-Version: 2.5.0
+Version: 2.7.0
 Summary: BDD compliance testing for GitLab CI/CD pipelines and project settings — by MaturityBuilder
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -19,22 +19,22 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: Software Development :: Testing
 Requires-Dist: behave (>=1.2.6,<2.0.0)
-Requires-Dist: click (>=8.1.8,<9.0.0)
-Requires-Dist: idna (==3.18)
+Requires-Dist: click (>=8.5.0,<9.0.0)
+Requires-Dist: idna (==3.20)
 Requires-Dist: jq (==1.12.0)
 Requires-Dist: loguru (==0.7.2)
 Requires-Dist: markdown-analysis (==0.1.5)
-Requires-Dist: oras (==0.2.42)
+Requires-Dist: oras (==0.2.43)
 Requires-Dist: oyaml
 Requires-Dist: prettytable
 Requires-Dist: pytablewriter (==1.2.1)
-Requires-Dist: python-gitlab (==8.4.0)
+Requires-Dist: python-gitlab (==8.6.0)
 Requires-Dist: pyyaml (==6.0.3)
 Requires-Dist: requests (==2.34.2)
 Requires-Dist: rich (==15.0.0)
-Requires-Dist: semver (==3.0.4)
-Requires-Dist: typer (==0.27.0)
-Requires-Dist: urllib3 (==2.7.0)
+Requires-Dist: semver (==3.1.0)
+Requires-Dist: typer (==0.27.2)
+Requires-Dist: urllib3 (==2.8.0)
 Project-URL: Documentation, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Home Page, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Repository, https://github.com/MaturityBuilder/gitlab-compliance

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitlab-compliance"
-version = "2.5.0"
+version = "2.7.0"
 dynamic = [ "readme" ]
 license = "Apache-2.0"
 requires-python = ">=3.12"
@@ -40,18 +40,18 @@ python = ">=3.12"
 prettytable = "*"
 pytablewriter = "1.2.1"
 oyaml = "*"
-typer = "0.27.0"
+typer = "0.27.2"
 markdown-analysis = "0.1.5"
-urllib3 = "2.7.0"
+urllib3 = "2.8.0"
 jq = "1.12.0"
-click = "^8.1.8"
-semver = "3.0.4"
+click = "^8.5.0"
+semver = "3.1.0"
 pyyaml = "6.0.3"
 loguru = "0.7.2"
-python-gitlab = "8.4.0"
+python-gitlab = "8.6.0"
 rich = "15.0.0"
-oras = "0.2.42"
-idna = "3.18"
+oras = "0.2.43"
+idna = "3.20"
 requests = "2.34.2"
 behave = "^1.2.6"
 
@@ -60,11 +60,13 @@ gitlab-docs = 'src.gitlab_compliance:gitlab_compliance'
 gitlab-compliance = 'src.gitlab_compliance:gitlab_compliance'
 
 [tool.poetry.group.dev.dependencies]
-setuptools = "83.0.0"
+setuptools = "84.1.0"
 pytest = "^9.0.3"
-pre-commit = "^4.6.1"
+pytest-xdist = "^3.8.0"
+pytest-cov = "^7.1.0"
+pre-commit = "^4.6.2"
 pyyaml = "^6.0.3"
-coverage = "^7.9.2"
+coverage = "^7.16.2"
 
 [tool.black]
 line-length = 88
@@ -77,7 +79,7 @@ max-line-length = 88
 extend-ignore = ["E203", "W503"]
 
 [tool.poetry.group.docs.dependencies]
-zensical = "^0.0.51"
+zensical = "^0.0.67"
 [build-system]
 requires = ["poetry-core","setuptools","poetry-bumpversion","id"]
 build-backend = "poetry.core.masonry.api"

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/behave_support/environment.py

@@ -37,6 +37,10 @@ def before_scenario(context, scenario):
     if not context.compliance_entities:
         depth_raw = context.config.userdata.get("max_include_depth", "")
         max_include_depth = int(depth_raw) if str(depth_raw).strip() else None
+        generated_raw = context.config.userdata.get("generated_configs", "") or ""
+        generated_configs = tuple(
+            part.strip() for part in str(generated_raw).split(",") if part.strip()
+        )
         context.compliance_entities = load_pipeline_entities(
             pipeline_file=pipeline,
             include_nested=context.config.userdata.get("include_nested", "true")
@@ -54,6 +58,9 @@ def before_scenario(context, scenario):
             resolve_external_includes=_resolve_external_flag(
                 context.config.userdata.get("resolve_external_includes", "auto")
             ),
+            resolve_generated=context.config.userdata.get("resolve_generated", "true")
+            == "true",
+            generated_configs=generated_configs or None,
             cache=getattr(context, "release_cache", None),
         )
 

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/behave_support/steps/given_steps.py

@@ -107,6 +107,25 @@ def given_any_container_image_with_release_metadata(context):
     )
 
 
+@given("I have any dynamic child pipeline defined")
+def given_any_dynamic_child_pipeline(context):
+    _set_stash(context, context.compliance_entities.get("dynamic_child_pipelines", []))
+
+
+@given('I have dynamic child pipeline "{name}" defined')
+def given_named_dynamic_child_pipeline(context, name):
+    pipelines = [
+        item
+        for item in context.compliance_entities.get("dynamic_child_pipelines", [])
+        if item.get("name") == name or item.get("trigger_job") == name
+    ]
+    _set_stash_or_skip(
+        context,
+        pipelines,
+        skip_reason=f'No dynamic child pipeline named "{name}" found in pipeline',
+    )
+
+
 @given("I have any variable defined")
 def given_any_variable(context):
     _set_stash(context, context.compliance_entities.get("variables", []))

gitlab_compliance-2.7.0/src/compliance/builtin_policies/baseline-jobs.feature

@@ -0,0 +1,45 @@
+# METADATA
+# title: Baseline job controls
+# description: Core job image and execution rules bundled with gitlab-compliance.
+# custom:
+#   id: GLCI-BUILTIN-BASELINE
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+Feature: Baseline job controls
+
+# METADATA
+# title: Job images must not use the latest tag
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+  Scenario: Job images must not use the latest tag
+    Given I have any job defined
+    When it has image
+    Then its image must not match ":latest$"
+
+# METADATA
+# title: Non-template jobs must define rules
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-1
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.32
+  Scenario: Non-template jobs must define rules
+    Given I have any job defined
+    When its name does not start with "."
+    Then it must contain rules

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/component-inputs.feature

@@ -2,10 +2,27 @@
 # title: Component input constraints
 # description: Advanced Scenario Outline for component inputs and conditional fields.
 # custom:
-#   id: GLCI-BUILTIN-COMPONENT-INPUTS
+#   id: GLCI-BUILTIN-COMPONENT
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
 Feature: Component input constraints
 
+# METADATA
+# title: Component input mode constrains dependent fields
+# custom:
+#   id: GLCI-BUILTIN-COMPONENT-01
+#   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario Outline: Component input mode constrains dependent fields
     Given I have include type "component" defined
     When the entity input <input> equals <value>

gitlab_compliance-2.7.0/src/compliance/builtin_policies/include-pinning.feature

@@ -0,0 +1,46 @@
+# METADATA
+# title: Include pinning essentials
+# description: Baseline checks for component and fragment version pinning.
+# custom:
+#   id: GLCI-BUILTIN-INCPIN
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+Feature: Include pinning essentials
+
+# METADATA
+# title: Component includes must not track a branch
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must not track a branch
+    Given I have include type "component" defined
+    Then its version must not match "^(main|master|develop)$"
+
+# METADATA
+# title: Component includes must use semver
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must use semver
+    Given I have include type "component" defined
+    Then its version must match "^\\d+\\.\\d+\\.\\d+(-[\\w.]+)?$"

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-ci-conventions.feature

@@ -2,15 +2,24 @@
 # title: GitLab CI script conventions
 # description: CI-specific hygiene for curl and deprecated variables.
 # custom:
-#   id: GLCI-SHELL-CI
+#   id: GLCI-BUILTIN-SHELL-CI
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.28
 Feature: GitLab CI script conventions
 
 # METADATA
 # title: curl uses fail flag
 # custom:
-#   id: GLCI-SHELL-CI-001
+#   id: GLCI-BUILTIN-SHELL-CI-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: curl must use fail flag
     Given I have any job with effective script defined
     Then curl must use fail flag
@@ -18,8 +27,13 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: Deprecated CI_BUILD variables are not used
 # custom:
-#   id: GLCI-SHELL-CI-002
+#   id: GLCI-BUILTIN-SHELL-CI-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario: Deprecated CI_BUILD variables must not be used
     Given I have any job with effective script defined
     Then deprecated CI_BUILD variables must not be used
@@ -27,8 +41,12 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: CI variables should be quoted
 # custom:
-#   id: GLCI-SHELL-CI-003
+#   id: GLCI-BUILTIN-SHELL-CI-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: CI variables should be quoted
     Given I have any job with effective script defined
     Then user supplied variables must be quoted or validated

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-command-substitution.feature

@@ -2,15 +2,23 @@
 # title: Command substitution standards
 # description: Prefer modern dollar-parentheses substitution over backticks.
 # custom:
-#   id: GLCI-SHELL-SUB
+#   id: GLCI-BUILTIN-SHELL-SUB
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Command substitution
 
 # METADATA
 # title: Legacy backticks are not used
 # custom:
-#   id: GLCI-SHELL-SUB-001
+#   id: GLCI-BUILTIN-SHELL-SUB-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Legacy backticks are not used
     Given I have any job with effective script defined
     Then command substitution must use dollar parentheses
@@ -18,8 +26,12 @@ Feature: Command substitution
 # METADATA
 # title: Nested command substitution is readable
 # custom:
-#   id: GLCI-SHELL-SUB-002
+#   id: GLCI-BUILTIN-SHELL-SUB-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Nested command substitution is readable
     Given I have any job with effective script defined
     Then nested command substitution must use dollar parentheses

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-conditionals.feature

@@ -2,15 +2,23 @@
 # title: Conditional expression standards
 # description: Portable and safely quoted test expressions.
 # custom:
-#   id: GLCI-SHELL-TEST
+#   id: GLCI-BUILTIN-SHELL-TEST
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Conditional expressions
 
 # METADATA
 # title: Test operators are portable
 # custom:
-#   id: GLCI-SHELL-TEST-001
+#   id: GLCI-BUILTIN-SHELL-TEST-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Test operators are portable
     Given I have any job with effective script defined
     Then POSIX compliant operators must be used
@@ -18,8 +26,12 @@ Feature: Conditional expressions
 # METADATA
 # title: Variables are quoted in test statements
 # custom:
-#   id: GLCI-SHELL-TEST-002
+#   id: GLCI-BUILTIN-SHELL-TEST-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Variables are quoted in test statements
     Given I have any job with effective script defined
     Then variables in test expressions must be quoted

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-error-handling.feature

@@ -2,15 +2,24 @@
 # title: Error handling
 # description: Strict mode and exit-code handling for GitLab CI job scripts.
 # custom:
-#   id: GLCI-SHELL-ERR
+#   id: GLCI-BUILTIN-SHELL-ERR
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
 Feature: Error handling
 
 # METADATA
 # title: Scripts use strict mode
 # custom:
-#   id: GLCI-SHELL-ERR-001
+#   id: GLCI-BUILTIN-SHELL-ERR-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Multi-line scripts use strict mode
     Given I have any job with effective script defined
     When the effective script has more than 1 line
@@ -19,8 +28,12 @@ Feature: Error handling
 # METADATA
 # title: Commands return meaningful exit codes
 # custom:
-#   id: GLCI-SHELL-ERR-002
+#   id: GLCI-BUILTIN-SHELL-ERR-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Commands return meaningful exit codes
     Given I have any job with effective script defined
     Then failure must be handled explicitly
@@ -28,8 +41,12 @@ Feature: Error handling
 # METADATA
 # title: Functions propagate failures
 # custom:
-#   id: GLCI-SHELL-ERR-003
+#   id: GLCI-BUILTIN-SHELL-ERR-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Functions propagate failures
     Given I have any job with effective script defined
     Then functions must propagate failures

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-file-operations.feature

@@ -2,15 +2,23 @@
 # title: Safe file operations
 # description: Quoted paths, secure temps, and protected recursive rm.
 # custom:
-#   id: GLCI-SHELL-FILE
+#   id: GLCI-BUILTIN-SHELL-FILE
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Safe file operations
 
 # METADATA
 # title: File paths are quoted
 # custom:
-#   id: GLCI-SHELL-FILE-001
+#   id: GLCI-BUILTIN-SHELL-FILE-01
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: File paths are quoted
     Given I have any job with effective script defined
     Then file paths must be quoted
@@ -18,8 +26,12 @@ Feature: Safe file operations
 # METADATA
 # title: Temporary files are securely created
 # custom:
-#   id: GLCI-SHELL-FILE-002
+#   id: GLCI-BUILTIN-SHELL-FILE-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Temporary files are securely created
     Given I have any job with effective script defined
     When temporary files are required
@@ -28,8 +40,12 @@ Feature: Safe file operations
 # METADATA
 # title: Dangerous rm operations are protected
 # custom:
-#   id: GLCI-SHELL-FILE-003
+#   id: GLCI-BUILTIN-SHELL-FILE-03
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Dangerous rm operations are protected
     Given I have any job with effective script defined
     When rm is used recursively

{gitlab_compliance-2.5.0 → gitlab_compliance-2.7.0}/src/compliance/builtin_policies/shell/shell-pinning.feature

@@ -2,15 +2,27 @@
 # title: CI script dependency pinning
 # description: Supply-chain pinning controls for packages and downloads in CI scripts.
 # custom:
-#   id: GLCI-SHELL-PIN
+#   id: GLCI-BUILTIN-SHELL-PIN
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
 Feature: CI script dependency pinning
 
 # METADATA
 # title: Downloads must verify checksums
 # custom:
-#   id: GLCI-SHELL-PIN-001
+#   id: GLCI-BUILTIN-SHELL-PIN-01
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: Script downloads must verify checksums
     Given I have any job with effective script defined
     Then script downloads must verify checksums
@@ -18,8 +30,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: Disallow remote pipe to shell
 # custom:
-#   id: GLCI-SHELL-PIN-002
+#   id: GLCI-BUILTIN-SHELL-PIN-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-4
+#   iso27001:
+#     - A.8.28
+#     - A.8.25
   Scenario: Scripts must not pipe remote downloads to a shell
     Given I have any job with effective script defined
     Then untrusted remote scripts must not be executed
@@ -28,8 +46,14 @@ Feature: CI script dependency pinning
 # title: pip packages must be version-pinned
 # description: Applies to both pip and pip3 install commands in job scripts.
 # custom:
-#   id: GLCI-SHELL-PIN-003
+#   id: GLCI-BUILTIN-SHELL-PIN-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: pip install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "pip" must use pinned versions
@@ -37,8 +61,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: apk packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-004
+#   id: GLCI-BUILTIN-SHELL-PIN-04
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: apk add must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "apk" must use pinned versions
@@ -46,8 +76,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: apt packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-005
+#   id: GLCI-BUILTIN-SHELL-PIN-05
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: apt-get install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "apt" must use pinned versions
@@ -55,8 +91,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: npm global packages must be version-pinned
 # custom:
-#   id: GLCI-SHELL-PIN-006
+#   id: GLCI-BUILTIN-SHELL-PIN-06
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: npm global installs must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "npm" must use pinned versions
@@ -64,8 +106,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: go install must pin versions
 # custom:
-#   id: GLCI-SHELL-PIN-007
+#   id: GLCI-BUILTIN-SHELL-PIN-07
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: go install must pin module versions
     Given I have any job with effective script defined
     Then package installs of type "go" must use pinned versions
@@ -73,8 +121,14 @@ Feature: CI script dependency pinning
 # METADATA
 # title: git clone must verify revision
 # custom:
-#   id: GLCI-SHELL-PIN-008
+#   id: GLCI-BUILTIN-SHELL-PIN-08
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: git clone must verify commit or tag
     Given I have any job with effective script defined
     Then git clone must verify commit or tag
@@ -83,8 +137,14 @@ Feature: CI script dependency pinning
 # title: docker run and pull must pin images
 # description: Script docker commands must reference an explicit tag or sha256 digest.
 # custom:
-#   id: GLCI-SHELL-PIN-009
+#   id: GLCI-BUILTIN-SHELL-PIN-09
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: docker run and pull must pin container images
     Given I have any job with effective script defined
     Then docker commands must pin container images to a tag or sha256 digest
@@ -93,8 +153,14 @@ Feature: CI script dependency pinning
 # title: yum/dnf packages must be version-pinned
 # description: Applies to yum, dnf, and microdnf install commands in job scripts.
 # custom:
-#   id: GLCI-SHELL-PIN-010
+#   id: GLCI-BUILTIN-SHELL-PIN-10
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
   Scenario: yum and dnf install must pin package versions
     Given I have any job with effective script defined
     Then package installs of type "yum" must use pinned versions