Securing the build services and workers
Earlier in this chapter, we established that developers and DevOps teams use build services such as GitHub Actions and Azure Pipelines to define automated processes for building software. These processes run on systems called build workers. Different platforms have different names for these workers. In Azure Pipelines, they are known as agents, and in GitHub Actions, they are called runners.
We need to keep the build services, the automated processes, and the build workers secure as part of our build phase security efforts. If an attacker gains access to the build service or workers, they could insert malicious code or manipulate the build process, leading to compromised software.
Securing the build workers
There are two main types of build workers: platform-hosted workers and self-hosted workers. Platform-hosted workers are virtual machines provided and managed by the platform provider (Microsoft-hosted/GitHub-hosted). Self-hosted workers...
