CI/CD Pipeline Security

• Attackers target the pipeline because one build compromise fan out to every artifact it produces.
• A leaked CI credential with prod scope is a full privilege to your release path.
• Supply-chain incidents (e.g. a malicious dependency, a poisoned runner) live and die here.

Compromise the truck (the runner) and every delivery that day carries the surprise — even if each bread recipe looked fine.

• Runners execute untrusted-ish code in isolated, disposable environments, not the engineer's laptop.
• Secrets live in scoped vault/stores injected only for the job that needs them, never in logs.
• Artifacts are signed at the end of a hardened build so later stages can verify provenance.
• Supply-chain controls (pin hashes, verify trusted actions, deny untrusted forks) bind each step.

• An org pins every third-party action to a commit SHA and denies unknown-forks in PRs — the Log4shell-era lesson.
• A platform injects short-lived OIDC tokens instead of long-lived keys, so CI can't persist privileges.
• A release pipeline signs images and then admission verifies in staging before production promotion.

• Least privilege the runner: read-clone, scoped secrets, scope-limited cloud roles.
• Pin actions/dependencies to digests or SHAs and require approval for new ones.
• Use OIDC/federated short-lived credentials over long-lived CI keys wherever possible.
• Clean the runner after every job and never run untrusted PRs on protected runners.

• A single 'build' secret with full admin on every stage, rotated never.
• Running checkout of a fork on a self-hosted runner with host access.
• Signing artifacts with a key stored beside the pipeline the same scripts can read.
• Ignoring the pipeline's own config in security reviews — the watchers unwatched again.

• When an 'approved' action misbehaves, pin it to a SHA and diff the vendor's release notes.
• Audit runner logs for secret leakage: any value echoed in output is a leak event to rotate.
• Test permission boundaries with a can-it pipeline: a job that tries to read a neighbor's secret and must fail.

• Treat the pipeline as a privileged system: its logs, runners, and artifacts all carry release authority.
• Secrets found in pipeline output are incidents: rotate and inspect what the job could touch.