How do you secure the CI/CD pipeline itself against supply-chain attacks?

Summary

Treat the pipeline as production infrastructure: pin third-party actions and plugins to commit SHAs, minimise and scope permissions (read-only tokens by default), isolate untrusted code (forked pull requests) from secrets, use ephemeral, hardened runners, protect branches and require reviews for pipeline changes, verify dependencies, and produce signed artifacts with provenance.

Longer Answer

Real incidents (compromised GitHub Actions, malicious npm packages, the SolarWinds and Codecov breaches) show the pipeline is a high-value target because it holds credentials and produces what runs in production. Frameworks such as SLSA define increasing levels of build integrity: scripted builds, provenance, hardened isolated builders, and two-person review. Self-hosted runners on persistent machines are risky for public repositories because a malicious job can persist on the host.

Key Points

• Pin actions by SHA; least-privilege tokens.
• Isolate untrusted PRs from secrets.
• Ephemeral hardened runners.
• Signed artifacts with provenance (SLSA).