1. Executive Summary & Scope
Supply chain attacks increasingly target build environments rather than production code directly. If an attacker gains write access to CI/CD workflows, build runner secrets, or container registries, they can inject backdoors directly into release binaries without touching source code repositories.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-1395 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Adversaries tamper with GitHub Actions or Jenkins pipelines to exfiltrate deployment credentials, inject malicious telemetry into web assets, or replace signed production docker images.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
# VULNERABLE: CI Workflow pulling unpinned actions and exposing all secrets
name: Build & Deploy
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- run: npm install && npm run build
# Deploys directly using broad unrestricted cloud credentials
- run: ./deploy.sh
env:
AWS_SECRET_ACCESS_KEY: ${{ secrets.SUPER_KEY }}
Hardened Defense-in-Depth Implementation
# REMEDIATED: Pinned commit hashes, least privilege OIDC, and Sigstore attestation
name: Hardened Build
on:
push:
branches: [main]
permissions:
contents: read
id-token: write # Required for AWS OIDC authentication (no static secrets)
jobs:
build:
runs-on: ubuntu-latest
steps:
# Pin actions to immutable commit SHAs
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Verify Signed Commits
run: git verify-commit HEAD
- name: Generate SLSA Provenance
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Static Secret Audit in CI | Audit CI/CD runners to verify zero permanent credentials stored in runner environments. | Short-lived OIDC tokens replace long-lived static secrets. |
| Action SHA Immutability | Verify all third-party GitHub Actions are pinned to full 40-character commit hashes. | Zero mutable tags (@v1, @main) permitted in pipeline definitions. |
| Binary Attestation Check | Verify released Docker images and zip artifacts against Sigstore / Cosign public keys. | Deployments reject unsigned or untrusted provenance attestations. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.