Limit building pull requests from forked GitHub repositories

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Pipelines · All checks

Run this check

Invoke-Maester -TestId AZDO.1022

Overview

Azure DevOps pipelines should not automatically build on every pull request and commit from a GitHub repository.

Rationale: Code should not be automatically built from GitHub.

Remediation action

Enable the policy to stop building from GitHub repositories.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section “Triggers” and turn on “Limit building pull requests from forked GitHub repositories”

Related links

• Learn - Validate contributions from forks

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1022
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Pipelines
Area	Engineering systems
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1677 Poisoned Pipeline Execution
PowerShell test	Test-AzdoOrganizationTriggerPullRequestGitHubRepository
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#validate-contributions-from-forks

Source

• Test: tests/maester/azure-devops/Test.AZDO.1022.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1022.md