What you'll learn
- Shift left, and shield right
- Pipeline security controls
- Protecting the pipeline itself
- Supply chain integrity: SLSA and signing
Lessons
1Shift left, and shield right
Move checks earlier (IDE plugins, pre-commit hooks, PR scans) so fixes are cheap, and keep runtime protection (WAF, RASP, monitoring) because not every bug is caught early. Make security feedback fast and in the developer's tools.
2Pipeline security controls
- Secrets scanning (gitleaks, GitHub secret scanning) with push protection.
- SAST (Semgrep, CodeQL) on pull requests.
- SCA (Dependabot, OSV-Scanner) with auto-fix PRs.
- IaC scanning (Checkov, tfsec, KICS) for Terraform, Bicep, Kubernetes YAML.
- Container scanning (Trivy, Grype) before images are pushed.
- DAST (OWASP ZAP baseline) against staging.
3Protecting the pipeline itself
CI/CD systems hold the keys to production. Use OIDC federation instead of long-lived cloud keys, pin third-party actions to a commit SHA, restrict who can modify workflows, require reviews on protected branches, and isolate runners for untrusted pull requests.
4Supply chain integrity: SLSA and signing
SLSA levels describe how trustworthy a build's provenance is. Sign artifacts and images with Sigstore cosign, publish SBOMs, and verify signatures at deploy time with admission controllers (Kyverno, Gatekeeper).
Hands-on lab: Add security gates to a GitHub repo
- Create a test repository with a small app.
- Enable Dependabot alerts and secret scanning with push protection.
- Add a workflow that runs
gitleaksandsemgrep --config autoon pull requests. - Add
trivy fs .to scan dependencies and IaC files. - Open a PR that adds a fake test secret like
AKIAEXAMPLEEXAMPLE00and confirm the gate blocks it.
Outcome: A pipeline that blocks secrets and flags vulnerable code before merge.
Practice questions
Best way for a CI job to authenticate to cloud?
Answer: OIDC federation with short-lived tokens. No stored long-lived credentials.
Pinning a third-party GitHub Action to a commit SHA protects against…
Answer: A tag being moved to malicious code. Tags are mutable; SHAs are not.
Checkov and tfsec scan…
Answer: Infrastructure-as-code. They find misconfigurations in IaC.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Shift left
- Moving security checks earlier in the development lifecycle.
- IaC scanning
- Checking Terraform, Bicep or Kubernetes manifests for misconfigurations.
- SLSA
- Supply-chain Levels for Software Artifacts: framework for build integrity.
- Secrets scanning
- Detecting credentials committed to code repositories.
- OIDC federation (CI)
- CI jobs exchanging a signed identity token for short-lived cloud credentials.
- Admission controller
- Kubernetes component that can reject non-compliant or unsigned workloads.
See the full cyber security glossary →