---
okf_version: '0.2'
---

# Resource types

* [Default](/types/Default.md) - GitLab::CI::Default
* [Job](/types/Job.md) - GitLab::CI::Job
* [Workflow](/types/Workflow.md) - GitLab::CI::Workflow

# Rules

* [WGL001](/rules/WGL001.md) - Deprecated only/except keywords
* [WGL002](/rules/WGL002.md) - Missing script
* [WGL003](/rules/WGL003.md) - Missing stage
* [WGL004](/rules/WGL004.md) - Artifacts without expiry
* [WGL010](/rules/WGL010.md) - Job references a stage not in the stages list
* [WGL011](/rules/WGL011.md) - Job has rules that always evaluate to never (unreachable)
* [WGL012](/rules/WGL012.md) - Deprecated property usage — flags properties marked as deprecated in the GitLab CI schema
* [WGL013](/rules/WGL013.md) - Invalid needs: target — dangling reference or self-reference
* [WGL014](/rules/WGL014.md) - Invalid extends: target — references a template not in the pipeline
* [WGL015](/rules/WGL015.md) - Circular needs: chain — cycle in job dependency graph
* [WGL016](/rules/WGL016.md) - Secrets in variables — hardcoded passwords or tokens in variables blocks
* [WGL017](/rules/WGL017.md) - Insecure registry — Docker push/pull to non-HTTPS registry
* [WGL018](/rules/WGL018.md) - Missing timeout — jobs without explicit timeout may run too long
* [WGL019](/rules/WGL019.md) - Missing retry — deploy jobs without retry strategy
* [WGL020](/rules/WGL020.md) - Duplicate job names — multiple jobs resolving to same name
* [WGL021](/rules/WGL021.md) - Unused variables — global variables not referenced by any job
* [WGL022](/rules/WGL022.md) - Missing artifacts expiry — artifacts without expire_in cause disk bloat
* [WGL023](/rules/WGL023.md) - Overly broad rules — job with only when: always rule (no conditions)
* [WGL024](/rules/WGL024.md) - Manual without allow_failure — manual jobs block pipeline without allow_failure: true
* [WGL025](/rules/WGL025.md) - Missing cache key — cache without key causes collisions
* [WGL026](/rules/WGL026.md) - Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR
* [WGL027](/rules/WGL027.md) - Empty script — jobs with empty or blank script entries
* [WGL028](/rules/WGL028.md) - Redundant needs — needs listing jobs already implied by stage ordering
* [WGL029](/rules/WGL029.md) - include:project / component resolved by a moving ref instead of a pinned tag or SHA
* [WGL030](/rules/WGL030.md) - include:remote is insecure (HTTP) or mutable
* [WGL031](/rules/WGL031.md) - Container image not pinned to an immutable digest
* [WGL032](/rules/WGL032.md) - Include/component source resembles a well-known project (possible impersonation)
* [WGL033](/rules/WGL033.md) - OIDC id_token without a scoped audience
* [WGL034](/rules/WGL034.md) - OIDC id_token mintable from a merge-request pipeline
* [WGL035](/rules/WGL035.md) - Untrusted CI variable interpolated into a script command
* [WGL036](/rules/WGL036.md) - Privileged service / DinD reachable from merge-request pipelines
* [WGL037](/rules/WGL037.md) - Security gate on a regex match of an untrusted ref variable
* [WGL038](/rules/WGL038.md) - Secret-like variable reachable from a merge-request pipeline
* [WGL039](/rules/WGL039.md) - Secret-like variable printed to job logs
* [WGL040](/rules/WGL040.md) - Hardcoded credential in a registry login command
* [WGL041](/rules/WGL041.md) - Logically unsound (tautological) rules:if condition
* [WGL042](/rules/WGL042.md) - Unreachable rules after an unconditional match
* [WGL043](/rules/WGL043.md) - Match-anything regex gate in rules:if
* [WGL044](/rules/WGL044.md) - Public artifacts expose build output
* [WGL045](/rules/WGL045.md) - Artifact path that may capture a credential file
* [WGL046](/rules/WGL046.md) - Cache populated in a merge-request pipeline (poisoning risk)
* [WGL047](/rules/WGL047.md) - Software fetched and piped to a shell without verification
* [WGL048](/rules/WGL048.md) - Pipeline defines workflow: but no workflow:name