Checklist · Delivery

CI/CD pipeline hardening

Protects the path from commit to production, which attackers prefer to the production systems themselves.

Owner: DevOps and engineering leadsTime: 1 hour

0 of 19

Source control

The default branch is protected: no direct pushes, required reviews, required status checks.
Workflow and pipeline files, Dockerfiles and deploy scripts have code owners who must approve changes.
Commit signing or verified authors are required for release branches.
Admin rights on the repository are limited to a few named people, with MFA.

Cloud access uses short-lived federation (OIDC) rather than stored long-lived keys.
Each environment has its own credentials; staging cannot deploy to production.
Secrets are not exposed to pull requests from forks and are masked in logs.
The default token permission is read-only; jobs request the extra permissions they need.
Stored secrets have an owner and a rotation date, and unused ones are deleted.

Third-party actions and plugins are pinned to a full commit hash, not a movable tag.
Runners are ephemeral; self-hosted runners are isolated and never run code from public forks.
Workflows that run on untrusted pull requests do not check out and execute the PR code with secrets (for example pull_request_target).
Lockfiles are committed and installs use them; new dependencies are reviewed.
Build caches and artifacts cannot be written by untrusted jobs.

Production deploys need an approval from someone who did not write the change.
Artifacts are built once, stored in a registry with immutable tags, and deployed by digest.
Provenance or signatures are produced at build time and checked before deploy.
Security scans block a release on critical findings, and exceptions are recorded.
Pipeline audit logs are kept centrally, with alerts for changes to workflows, secrets and branch rules.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14 Tage kostenlos testen. Ohne Kreditkarte. Cloud oder on-premises.