Question

Your organization requires that every production deployment pipeline runs a mandatory security-scanning step and a credential-detection step that development teams cannot remove or bypass. Teams author their own YAML pipelines in separate repositories, but all pipelines must inherit the enforced steps. You want to guarantee compliance while still letting teams add their own build and test stages. Which approach should you implement?

Accepted Answer

Create an extends template in a shared repository that defines the required steps, and configure a pipeline (required template) check on the protected resource so pipelines that do not extend the approved template are blocked.

Answer

Provide a step template in a shared repository and instruct each team to include it near the top of their pipeline using the steps template syntax.

Answer

Add the security and credential-detection steps to a variable group and reference the variable group in each team's pipeline.

Answer

Use a decorator only in the build stage of each pipeline and rely on branch policies to prevent teams from editing the YAML.