Its purpose is to prevent unauthorized changes, credential theft, untrusted execution, artifact substitution, and misuse of the pipeline’s often powerful access to source repositories and production environments.
The pipeline should be treated as a production control plane. Security spans repository rules, automation services, runners, plug-ins, secrets, build inputs, artifact stores, signing or attestation services, release approvals, deployment credentials, logging, and recovery — not merely the checks inserted into a build.
Key points
Identity and flow controlSeparate human and workload identities, apply least privilege, protect administrative changes, require suitable review or approval, and restrict which events, branches, and actors can trigger privileged jobs.
Execution and dependenciesIsolate jobs, prefer ephemeral workers, pin or verify external actions and tools, constrain network access, and prevent untrusted contributions from receiving sensitive credentials.
Artifact integrityBind outputs to reviewed source and build instructions, record provenance, protect signing material, verify artifacts before promotion, and retain tamper-evident evidence for investigation.
Important limitationA protected pipeline does not establish that the software it releases is free of security defects. Conversely, adding application scanners does not secure the pipeline identities, runners, control plane, or artifact path that could alter or bypass their results.