cicd-security

# CI/CD SECURITY — Pipeline Attack Surface > CI/CD pipelines are high-value targets — a single workflow injection can give you code execution on the build server, read ALL org secrets, and push backdoored releases to production. --- ## 0. QUICK KILL CHECKLIST ``` [ ] Run cicd_scanner.sh <owner/repo> — catch low-hanging workflow lint issues [ ] Check for script injection: ${{ github.event.*.body/title/name }} [ ] Find secrets referenced in env: — test if they leak in logs [ ] Check pull_request_target with checkout of untrusted code [ ] Look for self-hosted runners on public repos [ ] Search for OIDC token requests without audience restriction [ ] Check for unpinned actions (uses: owner/action@main) [ ] Look for workflow_dispatch with no input validation [ ] Find artifact downloads without integrity checks [ ] Search for GITHUB_TOKEN with write permission used insecurely ``` --- ## 1. TOOL — cicd_scanner.sh ```bash # Single repo bash tools/cicd_scanner.sh owner/repo # Org-wide (up to 30 repos) bash tools/cicd_scanner.sh "org:orgname" --limit 50 --parallel 5 # Scan with recursive reusable workflow analysis bash tools/cicd_scanner.sh owner/repo --recursive --depth 5 # Custom output bash tools/cicd_scanner.sh owner/repo --output-dir ./findings/target/cicd ``` **Output:** `findings/<target>/cicd/scan_results.txt` + `summary.txt` **What sisakulint finds:** - Script injection via untrusted context - Unpinned actions (tag instead of SHA) - `pull_request_target` misuse - D...