01. Overview, Architecture & Supply Chain Threat Landscape
Explore CI/CD pipeline architecture, the OWASP Top 10 CI/CD Security Risks, SLSA v1.0 framework, and real-world supply chain attacks including SolarWinds, Codecov, and XZ Utils.
02. GitHub Actions & Runner Security Hardening
Master GitHub Actions security: Poisoned Pipeline Execution (PPE), pull_request_target vulnerabilities, script injection, action SHA pinning, and runner isolation.
03. Secrets Management & Dependency Supply Chain
Prevent pipeline secret leaks with TruffleHog and master mitigations for dependency confusion, typosquatting, and lockfile tampering across npm, PyPI, Go, and Maven.
04. OIDC Authentication & Cryptographic Artifact Signing
Eliminate static cloud credentials using OIDC for AWS/GCP/Azure and enforce container integrity with Sigstore/Cosign and Kyverno admission policy.
05. Pipeline Security Gates & Governance
Build an end-to-end security pipeline with TruffleHog, Semgrep, Trivy, zizmor, and Policy-as-Code (OPA Rego) alongside strict branch protection rules.
06. Hands-On Vulnerability Lab
Audit and exploit a vulnerable GitHub Actions workflow with a Poisoned Pipeline Execution (PPE) PoC script, then remediate and verify using an automated audit tool.
07. References & Standards
Authoritative security standards, CVE bibliography, framework specifications, and open-source tooling repositories for CI/CD Pipeline Security.
CI/CD Pipeline Security Masterclass
Master continuous integration and deployment security: supply chain threat landscape, GitHub Actions hardening, dependency confusion, OIDC auth, and Sigstore/Cosign image signing.