CI/CD Security: Protecting Your Pipeline

Why CI/CD Pipelines Are Targets

CI/CD pipelines have access to everything — production credentials, cloud provider keys, database URLs, and deployment infrastructure. A single compromised pipeline can lead to a full supply chain attack.

The SolarWinds Lesson

In 2020, attackers compromised SolarWinds' build pipeline and injected malicious code into a trusted software update. The attack went undetected for months because the pipeline itself had no integrity checks.

CI/CD Security Checklist

1. Secret Management

Never hardcode secrets in pipeline configuration:

# ❌ BAD: Plain text secret in YAML
- AWS_SECRET_ACCESS_KEY: "AKIAIOSFODNN7EXAMPLE"

# ✅ GOOD: Use secrets store
- AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

Use GitHub Encrypted Secrets, GitLab CI/CD Variables, or a vault like HashiCorp Vault.

2. Least-Privilege Tokens

Create dedicated deployment tokens with the minimum permissions needed:

A GitHub Actions token should only push to specific branches, not the entire repo
A cloud deployment key should only deploy to staging/production, not create resources

3. Pin Your Actions and Dependencies

Unpinned GitHub Actions can be silently updated by their maintainers to include malicious code:

- uses: actions/checkout@v4
+ uses: actions/checkout@v4.1.1  # Pin to specific SHA

4. Verify Build Artifacts

Use cryptographic signing to verify that artifacts haven't been tampered with:

gpg --verify artifact.tar.gz.sig artifact.tar.gz

5. Monitor Pipeline Activity

Sentinel's CI/CD integration checks for:

Unpinned third-party actions in your workflows
Hardcoded secrets in pipeline configuration
Overly permissive workflow triggers (e.g., pull_request_target)
Missing code review requirements on production branches

The Sentinel GitHub Action

Our Sentinel Grade action can be added to any workflow:

- name: Sentinel Security Check
  uses: sentinel/action@v1
  with:
    api-key: ${{ secrets.SENTINEL_API_KEY }}
    domain: staging.example.com
    fail-on: "CRITICAL"

Summary

Your CI/CD pipeline is part of your attack surface. Treat it as such: use short-lived tokens, pin dependencies, verify artifacts, and scan your pipeline configuration for vulnerabilities.