CI/CD Compliance Framework for Secure Pipelines

A widely used GitHub Action was compromised, exfiltrating CI/CD secrets from ~23,000 repositories. Any pipeline referencing a mutable version tag pulled the malicious code. This demonstrated the danger of unpinned action versions and the blast radius of a single compromised dependency.

Analysis on Snyk | Our dedicated article

Malicious npm packages combined with GitHub Actions exploitation to propagate across repositories, leveraging CI runner security weaknesses to exfiltrate secrets and spread laterally. The campaign illustrated how multiple attack vectors can chain together through the CI/CD pipeline.

Analysis on Aikido | Our dedicated article

Attackers injected code into the build process of SolarWinds Orion, affecting 18,000+ organizations and demonstrating that build provenance and artifact integrity are critical. The attack went undetected for months, highlighting the need for continuous monitoring of build systems.

An autonomous AI-powered bot scanned public repositories for exploitable GitHub Actions workflows and compromised 5 of 7 targeted repositories in one week. Targets included Aqua Security’s Trivy (25k+ stars, 178 releases deleted), awesome-go (140k+ stars, GITHUB_TOKEN with write permissions exfiltrated), CNCF’s akri, Microsoft’s ai-discovery-agent, and DataDog’s iac-scanner. Every exploit used a known, documented misconfiguration: pull_request_target with untrusted checkout, unescaped ${{ }} expressions in run: blocks, missing author_association checks, and excessive token permissions. No zero-days were involved.

StepSecurity Analysis | Our dedicated article | Trivy incident write-up 🇫🇷

CI/CD compliance means your pipelines meet defined security, quality, and governance standards. It covers how code is built, tested, and deployed, and ensures that these processes are auditable, repeatable, and aligned with regulatory frameworks like ISO 27001, NIS2, or DORA.

By producing audit-ready evidence: pipeline execution logs, configuration snapshots, secret scan reports, template compliance checks, and drift detection records. Continuous monitoring tools can generate this evidence automatically, rather than relying on manual spot checks.

Retain pipeline execution logs, security scan results (SAST, secret detection, dependency checks), branch protection configurations, merge request approval records, image scan reports, SBOM exports, and any drift detection alerts. Define a retention policy aligned with your regulatory requirements.

Enforce mandatory pipeline templates that cannot be overridden. Protect critical branches with approval rules and disable force push. Use automated controls to detect when required security scans are missing or when pipeline configurations deviate from the approved baseline.

Scope tokens to the minimum permissions required for each workflow. Use short-lived, automatically rotated credentials where possible. Restrict secret access to protected branches and environments. Monitor for overly broad token permissions across your CI runner security configuration.

Build provenance is a verifiable record of how a software artifact was built: what source code, what tools, what environment. It supports artifact integrity and traceability, which regulators increasingly require. SBOM generation and signing/attestations are practical ways to implement it.

ISO 27001 (information security management), NIS2 (network and information security), DORA (digital operational resilience for financial services), and the Cyber Resilience Act (CRA, product security for EU market) all include requirements that apply to CI/CD pipelines as part of the software supply chain.

Continuously. Point-in-time assessments miss configuration drift, new vulnerabilities, and evolving threats. Automated, continuous compliance monitoring is the only scalable approach for organizations running dozens or hundreds of pipelines.