Will GitLab accept this pipeline, and is it safe to push?
Paste or drop your .gitlab-ci.yml - and the local files it includes, if you have them.
Your browser resolves anchors, extends and default: the way GitLab does and
checks every job: stages that were never declared, needs and
extends that name nothing, rules mixed with only/except, script lines YAML reads as
mappings - and the dangerous ones: production deploys any branch can trigger,
terraform apply -auto-approve, secrets written into the file, curl piped
to sh, TLS checks switched off, :latest images. Free, before you sign in, and nothing is
uploaded. Then pick a lane: the audit writes the corrected block for each finding, or
the rewrite returns the whole file fixed - and the page re-checks it before you trust it.
The projects in the examples are invented. The first three are audits (the first also carries a saved rewrite, one click after the audit), the last two rewrites; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The audit confirms or dismisses every flag below, adds what rules cannot see, gives the corrected block for each finding and says when each job runs.
What this does, and what it does not
The check is a reading of the text, not a GitLab instance: nothing talks to GitLab, a runner or
your project settings. The file is parsed with its line numbers; anchors, <<:
merge keys, !reference, extends and default: are applied the
way GitLab applies them, and each flag carries the catalogue id it comes from and the line it points
at. Checks only see what you paste: paste the local files you include: to have their
jobs and templates read; remote, project, template and component includes are named but not read,
so names they might define are not reported as missing. Protected branches, masked variables and
the runner are outside the paste - the lanes ask rather than assume.
The paid lanes see your paste and the page's facts. Every quote, line and fix they return is checked against your paste, every fix and the rewritten file are re-checked, and a reply that repeats a secret from your paste is called out. A paste stays in this browser unless you run a lane - and if the free check finds a secret in it, rotate that secret whatever you do next. Derived from the agent skills @wshobson/gitlab-ci-patterns (wshobson/agents, MIT) and @akin-ozer/gitlab-ci-generator (akin-ozer/cc-devops-skills, Apache-2.0). Sources are listed in llms.txt.
GitLab is a trademark of GitLab Inc. Pushproof is not affiliated with or endorsed by GitLab Inc.