CI/CD Hardening
When to use
This skill treats the pipeline itself as the attack surface, not the code flowing through it. CI/CD compromise is a supply-chain incident: whoever owns the pipeline owns the release artifacts.
Triggers on:
- A question like "review our workflow files for security", "set up OIDC between GitHub and AWS", "why is
pull_request_targetdangerous", "pin all actions to SHA", "can we hit SLSA-L3". - New or changed
.github/workflows/*.yml,.gitlab-ci.yml, Jenkins
[Description truncada. Veja o README completo no GitHub.]