The CI/CD Supply Chain Hardening Checklist: Defending Against Poisoned Pipeline Execution Software supply chain attacks have fundamentally shifted. Adversaries are no longer focusing purely on runtime zero-days—they are targeting the automated build pipelines connecting developer pull requests directly to production. Between Poisoned Pipeline Execution (PPE) and compromised third-party GitHub Actions, insecure automation scripts often run with privileged execution rights, exposing cloud credentials and injecting backdoors into release artifacts before anyone notices. Securing source code isn't enough; you must secure the build environment itself. Audit your deployment and workflow configurations against this 5-Point CI/CD Pipeline Hardening Checklist: Markdown [ ] 1. WORKFLOW TRIGGER ISOLATION (ANTI-PPE) - [ ] Audit `pull_request_target`: Never check out untrusted PR head code in privileged `pull_request_target` workflows (prevents "Pwn Request" injection). - [ ] Dynamic Input Sanitization: Eliminate inline bash evaluation of untrusted parameters: # Critical Vulnerability run: echo "Processing ${{ github.event.issue.title }}" # Hardened Pattern env: TITLE: ${{ github.event.issue.title }} run: echo "Processing $TITLE" [ ] 2. THIRD-PARTY ACTION PINNING & PROVENANCE - [ ] Pin by Full Commit SHA: Replace mutable release tags (`@v3` or `@main`) with immutable 40-character commit SHAs (`@a1b2c3d...`) to neutralize tag-tampering attacks. - [ ] Automated SHA Renovate/Dependabot: Pair pinned SHAs with automated dependency update bots to keep pinned actions patched against upstream CVEs. - [ ] Restrict Action Origins: Enforce organization policies permitting only verified marketplace publishers and internal reusable workflows. [ ] 3. LEAST PRIVILEGE IDENTITY (ZERO STATIC SECRETS) - [ ] Restrict Default `GITHUB_TOKEN`: Explicitly declare top-level workflow permissions as `permissions: contents: read` instead of inheriting broad read/write defaults. - [ ] Migrate to OpenID Connect (OIDC): Eliminate long-lived AWS/GCP/Azure access keys stored in pipeline secrets; issue short-lived, cryptographically signed OIDC identity tokens. - [ ] Ephemeral Secrets Scoping: Restrict deployment credentials strictly to protected production environments requiring manual review gates. [ ] 4. RUNNER ISOLATION & EGRESS CONTROL - [ ] Ephemeral, Single-Use Runners: Run build jobs on isolated ephemeral container VMs destroyed immediately upon job completion to eliminate cross-build persistence. - [ ] Outbound Network Egress Filtering: Block unmonitored outbound internet traffic from build runners to prevent reverse shells and credential exfiltration to untrusted C2 endpoints. - [ ] Memory Inspection Defense: Disallow runner containers from running in unconfined `--privileged` mode or exposing host `/proc` file systems. [ ] 5. ARTIFACT INTEGRITY & BUILD PROVENANCE - [ ] Cryptographic Signing: Sign generated binaries, wheels, and container images using Sigstore/Cosign before publishing to registries. - [ ] Software Bill of Materials (SBOM): Automatically generate and cryptographically attach an SBOM (SPDX/CycloneDX) to every released build artifact. Rule of Thumb: Treat your CI/CD runners like internet-exposed production nodes: minimize their privileges, monitor their outbound egress, and assume third-party build actions could be untrusted. Discussion Question What is your organization's biggest blind spot in CI/CD pipelines right now: pinning third-party actions to immutable SHAs, or eliminating long-lived cloud keys in favor of OIDC? CTA (Join Cybersecurity & Ethical Hacking) Looking to stay ahead of software supply chain threats, cloud exploits, and red team defense tactics? Join Cybersecurity & Ethical Hacking by Techawks to dissect real-world threat vectors and harden modern infrastructure with top security practitioners.