Mitigating Software Supply Chain Attacks in CI/CD

Securing pipeline artifacts using cryptographic attestation, pinning actions, and container signing.

Most modern breaches don't kick down the front door — they arrive through your build pipeline: a poisoned dependency, a tampered action, an unsigned image. If CI can push to production, CI is production, and it needs to be secured like it.

The attack surface

• Third-party actions pinned to mutable tags that can be swapped underneath you.
• Dependencies pulled at build time with no integrity check.
• Artifacts and images deployed without provenance or signatures.

Defenses that pay off

• Pin actions and dependencies to immutable digests, not tags.
• Generate an SBOM and verify it on every build.
• Sign artifacts and images, and verify signatures before deploy.

# pin to an immutable commit SHA, never a floating tag
- uses: actions/checkout@8f4b7f8   # not @v4
# sign the built image with keyless cosign
- run: cosign sign --yes $IMAGE_DIGEST

None of this is exotic — it's hygiene. Pinning, provenance, and signing turn a silent supply-chain compromise into a build that simply fails closed.