Confirm that the following Advanced settings are toggled off unless needed for your use case:
- Build forked pull requests
- Pass secrets to builds from forked pull requests
Confirm that the following API only project settings are toggled on unless not needed for your use case:
Confirm no unexpected SSH keys, project API tokens, or integrations are present.
Confirm there are no unexpected technical or security contacts present. Add at least one if none are present.
Confirm contexts are restricted appropriately.
Ensure use of uncertified orbs is disabled if applicable.
Next Step: Outside the Config: Secret Management
Previous Step: Inside the Config: Dynamic Configuration
📑 Table of Contents
- Configuration Review Preparation
- Review Each Job for Improvement Opportunities
- Review Each Workflow for Improvement Opportunities
- High Level Improvement Opportunities
- Finalize Review