Goal of the Security module, level C4
A working, industrialized pipeline is not enough. If it is not secured, it becomes an attack vector. This module, the first of level C4 "Secure and equip", teaches you to protect your pipelines against real threats: code injection, secret leaks, supply chain compromise and non-compliance.
Prerequisites
This module assumes that you have worked through the three previous levels:
- Levels C1 "Write a pipeline and read its failures" and C2 "Deliver", grouped under the Fundamentals: YAML structure, variables, rules, runners, artifacts
- Level C3 "Industrialize", with Industrialization: templates, includes, DAG, orchestration
The 6 modules
| Module | Focus |
|---|---|
| 7 attacks that target your pipelines | CI/CD threat model, injection, exfiltration |
| Manage secrets without exposing them (in French) | Protected variables, masking, Vault integration |
| Protected branches and approvals (in French) | Merge request approvals, protected environments |
| Harden your pipelines in 10 measures | Least privilege, runner isolation, image pinning |
| Supply chain: SBOM and attestations (in French) | CycloneDX, SLSA, cosign, traceability |
| Audit, compliance and traceability (in French) | Audit events, compliance frameworks, pipeline execution policies (compliance pipelines are deprecated), reports |
Recommended path
Do you want to understand the risks before fixing them?
Do you need to prove the compliance of your pipelines?
- Supply chain: SBOM and attestations (in French)
- Audit, compliance and traceability (in French)
- Protected branches and approvals (in French)
Do you want to secure your existing pipelines quickly?
- Harden your pipelines in 10 measures
- Manage secrets without exposing them (in French)
- Protected branches and approvals (in French)
Getting started
If you do not know where to start, begin with 7 attacks that target your pipelines to understand the real threats before securing anything. Follow up with Manage secrets without exposing them (in French) (protected variables, masking, Vault integration), then Harden your pipelines in 10 measures to reduce the attack surface. Audit, compliance and traceability (in French) finally shows how to prove compliance at scale.