CI/CD Security - Pipeline Security Guide

Why is CI/CD Security Important?

What is CI/CD security? CI/CD security is the set of practices and controls that protect the pipeline that builds, tests and deploys your software. It covers secrets management, access control for pipelines and runners, integrity checks for dependencies and artifacts, and automated security gates (SAST, SCA, container scanning) that stop vulnerable code from reaching production.

Your CI/CD pipeline has access to source code, credentials, production environments, and artifact repositories. A compromised pipeline can be used to deploy malware, steal secrets, or gain access to production. Pipeline security is a critical component of your DevSecOps strategy.

March 2026 showed this is not theoretical: attackers force-pushed almost all version tags of the trivy-action GitHub Action to malicious commits and published a rogue Trivy v0.69.4. Aqua Security advises treating every secret reachable from runners that used mutable tags at the time as compromised (Aqua Security).

DevSecOps Pipeline Architecture

Security Gates in CI/CD

1. Pre-commit

Checks before code is committed

Pre-commit hooks (secrets detection)
Linting and formatting
Local SAST scan

2. Build Stage

Checks during build

SAST - static code analysis
SCA - dependency analysis
Secret scanning (Gitleaks)
License compliance

3. Test Stage

Security tests

Unit tests with security assertions
Container image scanning (Trivy)
IaC scanning (Trivy trivy config, Checkov); tfsec is now part of Trivy

4. Deploy Stage

Pre-deployment checks

DAST - dynamic testing
Approval gates for production
Deployment verification

5. Post-deploy

Continuous monitoring

Runtime security monitoring
Vulnerability alerts
Compliance checks

Secrets Management

Proper handling of secrets (API keys, passwords, certificates) is one of the most important aspects of CI/CD security.

NEVER do this

Hardcoded secrets in code or pipeline configurations
Secrets in environment variables without encryption
Sharing secrets between environments (dev/prod)
Long-lived static access keys
Secrets in Docker images

Proper Secrets Handling

GitLab issues the job a short-lived OIDC token (id_tokens), which AWS STS exchanges for temporary credentials. The approach follows the GitLab documentation:

# Acceptable - static keys as protected + masked CI/CD variables
# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set in the project's
# CI/CD settings, never directly in .gitlab-ci.yml

# Better - OIDC (no static keys)
deploy:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com  # must match the audience of the AWS IAM OIDC provider
  script:
    - |
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" \
        $(aws sts assume-role-with-web-identity \
          --role-arn "$AWS_ROLE_ARN" \
          --role-session-name "gitlab-$CI_PROJECT_ID-$CI_JOB_ID" \
          --web-identity-token "$GITLAB_OIDC_TOKEN" \
          --duration-seconds 3600 \
          --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
          --output text))

# Best - OIDC + external secrets manager
deploy_with_secrets:
  # AWS credentials obtained via OIDC as in the job above
  script:
    - |
      # Retrieve secrets from AWS Secrets Manager only at job runtime
      export DB_PASSWORD=$(aws secretsmanager get-secret-value \
        --secret-id prod/db/password \
        --query SecretString --output text)

Example: Secure DevSecOps Pipeline

# .gitlab-ci.yml - DevSecOps Pipeline

stages:
  - test
  - build
  - scan
  - deploy

variables:
  DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  # Pin exact tool versions (ideally the @sha256 digest too), never :latest
  GITLEAKS_IMAGE: zricethezav/gitleaks:v8.30.1
  SEMGREP_IMAGE: semgrep/semgrep:1.181.0
  DEPCHECK_IMAGE: owasp/dependency-check:13.0.0
  TRIVY_IMAGE: aquasec/trivy:0.76.0

# ===== TEST STAGE =====

# Secret detection
gitleaks:
  stage: test
  image:
    name: $GITLEAKS_IMAGE
    entrypoint: [""]
  variables:
    GIT_DEPTH: 0  # full history so gitleaks scans every commit
  script:
    - gitleaks git . --report-format json --report-path gitleaks-report.json
  artifacts:
    paths: [gitleaks-report.json]
    when: always
  allow_failure: true

# SAST - static analysis (Semgrep CE, no login required)
semgrep:
  stage: test
  image: $SEMGREP_IMAGE
  script:
    - semgrep scan --config auto --json --output semgrep-results.json
  artifacts:
    paths: [semgrep-results.json]
    when: always
  allow_failure: true

# SCA - dependency scanning
dependency_check:
  stage: test
  image:
    name: $DEPCHECK_IMAGE
    entrypoint: [""]
  script:
    - /usr/share/dependency-check/bin/dependency-check.sh \
        --project "MyApp" \
        --scan . \
        --nvdApiKey "$NVD_API_KEY" \
        --format JSON \
        --out dependency-check-report.json
  artifacts:
    paths: [dependency-check-report.json]
    when: always
  allow_failure: true

# ===== BUILD STAGE =====

build_image:
  stage: build
  image: docker:29
  services:
    - docker:29-dind
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker build -t $DOCKER_IMAGE .
    - docker push $DOCKER_IMAGE
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ===== SCAN STAGE =====

# Container image scanning - security gate: HIGH/CRITICAL fails the pipeline
trivy:
  stage: scan
  image:
    name: $TRIVY_IMAGE
    entrypoint: [""]
  variables:
    TRIVY_USERNAME: $CI_REGISTRY_USER
    TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL \
        --format json --output trivy-results.json $DOCKER_IMAGE
  artifacts:
    paths: [trivy-results.json]
    when: always
  needs: [build_image]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ===== DEPLOY STAGE =====

deploy_staging:
  stage: deploy
  environment:
    name: staging
  script:
    - echo "Deploying to staging..."
  needs: [trivy]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy_production:
  stage: deploy
  environment:
    name: production
  script:
    - echo "Deploying to production..."
  needs: [deploy_staging]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual  # Requires manual approval

The example uses rules instead of the deprecated only/except keywords (GitLab Docs), gitleaks git instead of detect, which is deprecated since version 8.19.0 (Gitleaks), and semgrep scan, which unlike semgrep ci needs no Semgrep AppSec Platform account (Semgrep Docs). Without an NVD API key, Dependency-Check waits much longer between requests (OWASP Dependency-Check). The trivy image options are described in the Trivy CLI reference.

CI/CD Security Best Practices

Pipeline Configuration

Pipeline as Code in Git repository
Protected branches - no direct pushes to main
Required code reviews
Signed commits
Pinned versions of tools and images: GitHub Actions to a full commit SHA (GitHub Docs), container images to a digest
Build artifact provenance following SLSA v1.2

Secrets & Access

OIDC/Workload Identity instead of static keys
External secrets manager (Vault, AWS Secrets Manager)
Secrets rotation
Least privilege for pipeline service accounts
Audit logging of all access

Security Gates

Fail pipeline on critical findings
Manual approval for production deploys
Security review for infrastructure changes
Rollback mechanisms
Deployment windows

Security Risks in CI/CD

Based on the OWASP Top 10 CI/CD Security Risks:

Poisoned Pipeline Execution (PPE, CICD-SEC-4) - pipeline configuration manipulation
Dependency Confusion as part of Dependency Chain Abuse (CICD-SEC-3) - package manager exploitation
Credential theft from pipeline logs (Insufficient Credential Hygiene, CICD-SEC-6)
Supply chain attacks via build tools
Privilege escalation through self-hosted runners

Sources

OWASP: Top 10 CI/CD Security Risks (October 2026)
Aqua Security: Trivy Supply Chain Attack: What You Need to Know (April 2026)
GitLab Docs: Configure OpenID Connect in AWS to retrieve temporary credentials (October 2026)
GitLab Docs: Deprecated keywords (October 2026)
GitHub Docs: Secure use reference (October 2026)
Gitleaks: README (GitHub) (March 2026)
Aqua Security: tfsec is now part of Trivy (GitHub) (October 2026)
Trivy Docs: trivy image CLI reference (October 2026)
Semgrep Docs: Semgrep Community Edition in CI (October 2026)
OWASP Dependency-Check: CLI arguments (October 2026)
SLSA: Specification v1.2 (October 2026)