AZDO.1022 - Limit building pull requests from forked GitHub repositories.
Overview
Azure DevOps pipelines should not automatically build on every pull request and commit from a GitHub repository.
Rationale: Code should not be automatically built from GitHub.
Remediation action
Enable the policy to stop building from GitHub repositories.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Triggers" and turn on "Limit building pull requests from forked GitHub repositories"
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1022 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1677 Poisoned Pipeline Execution |
| PowerShell test | Test-AzdoOrganizationTriggerPullRequestGitHubRepository |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#validate-contributions-from-forks |