Securing build pipelines

Building secure software requires us to think about the integrity of all the components of our build pipelines. A build pipeline encompasses multiple steps, which are specific tasks such as collecting sources, compiling binaries, or running tests. The underlying infrastructure on which a build step runs is called a build worker. We’ll come back to the specific threats and mitigations regarding build workers soon. But the first thing to verify in your pipeline is the quality and integrity of the intrants.

Stage 1: Git workflow

The build pipeline begins with the software engineer writing new source code. This typically happens on the developer’s local workstation. From there, the code is added to the Git history using the git commit command. DevOps encourages developers to frequently merge code changes into a central repository where automated builds and tests run.

Code changes, not only to software but also to pipeline as code and infrastructure...