# Limit building pull requests from forked GitHub repositories

Azure DevOps pipelines should not automatically build on every pull request and commit from a GitHub repository.

Source: https://maester.dev/docs/tests/AZDO.1022

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1022
```

## Overview

Azure DevOps pipelines should not automatically build on every pull request and commit from a GitHub repository.

Rationale: Code should not be automatically built from GitHub.

#### Remediation action

Enable the policy to stop building from GitHub repositories.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section "Triggers" and turn on "Limit building pull requests from forked GitHub repositories"

#### Related links

* [Learn - Validate contributions from forks](https://learn.microsoft.com/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#validate-contributions-from-forks)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1022 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1677 Poisoned Pipeline Execution |
| PowerShell test | [Test-AzdoOrganizationTriggerPullRequestGitHubRepository](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1022.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#validate-contributions-from-forks](https://learn.microsoft.com/azure/devops/pipelines/repos/github?view=azure-devops&tabs=yaml#validate-contributions-from-forks) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1022.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1022.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1022.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1022.md)