auditing-cicd-oidc-trustlisted

# Auditing CI/CD OIDC trust: the pipeline is an identity, treat its inputs as hostile A modern pipeline is a privileged identity. It holds secrets, and it presents a short-lived token that a cloud account trusts and exchanges for real credentials. The danger is that the same pipeline also runs code and content that outsiders can influence: a change request from a fork, a dependency, a script in the repository. When untrusted input reaches a privileged step, or when the cloud trusts the pipeline's token too broadly, an outsider borrows the pipeline's identity. The audit is about where untrusted input meets pipeline privilege. ## When to use - You are reviewing CI/CD workflows, their triggers, and their secret and token access. - A pipeline exchanges a short-lived identity token for cloud credentials. - Any workflow runs on input from forks or external contributors. ## Scope check Review pipeline configuration in repositories and accounts you own or are authorized to test. If you can't name the authorization, stop. ## The loop 1. **Inventory triggers and what each run can reach.** For every workflow, record what event starts it, whether that event can be caused by an outside contributor, and what the run holds: repository secrets, an identity token, write permission to the repository or a registry. A run that both accepts outside input and holds privilege is the shape to chase. 2. **Find fork-triggered runs that keep secrets.** A workflow that runs on an