Command Palette

Search for a command to run...

Hectal
Phase 7Advanced8 of 9 in CI/CD

Pipeline Security & Best Practices

A pipeline that can deploy your application can, if compromised, do just as much damage as a compromised application itself — this phase covers protecting it accordingly.

Every phase so far has treated the pipeline as a trusted, neutral tool. This final phase treats it as what it genuinely is: a system with real access to your secrets, your cloud infrastructure, and your production environment — and covers the specific, concrete risks that come with that access, and how real teams close them.

0/4 · 0%
4 topics ~56 min 8 code blocks & diagrams
Start with the first topic
1
7.1

How Secrets Actually Leak From a Pipeline

Earlier phases covered storing secrets correctly — this topic covers the specific, genuinely common ways a correctly-stored secret still ends up exposed anyway, through logs, artifacts, and fork-originated pull requests.

14 min 1 diagram 1 code practice

2
7.2

Least Privilege & Short-Lived Credentials with OIDC

A long-lived cloud credential stored as a pipeline secret is a standing risk forever — OIDC lets a pipeline request a genuinely short-lived, scoped credential fresh for each run, with nothing long-lived to ever leak in the first place.

14 min 1 diagram 1 code practice

3
7.3

Supply Chain Basics: Pinning, Verification, and SBOMs

Every action, base image, and dependency your pipeline pulls in is code you didn't write, running with real access — pinning versions and verifying what you trust is the pipeline-level extension of the exact risk Git's own course covered for secrets.

14 min 1 diagram 1 code practice

4
7.4

Reviewing Pipeline Configuration Like Real Code

A malicious or careless change to a workflow file can exfiltrate secrets or deploy something harmful just as effectively as a malicious application code change — and it deserves exactly the same review rigor, protected by the same mechanisms.

14 min 1 diagram 1 code practice