CI/CD security: pipeline configuration, runners and tokens
You learn how a continuous integration pipeline works and where it carries secrets and privileges, and you set up pipeline files, runners and tokens safely.
Level 201 · 18 lessons · 15 practice labs
Lessons
Getting to know the pipeline
- How a pipeline works: trigger, stage, job, artefact
- The pipeline’s attack surface
- Pipeline as code: reading the config file
- Short task: find the jobs that touch secrets in a pipeline file
Secret variables
- CI variables: protected and masked
- The limits of masking: values leaking into logs
- Outside contributions and secrets: requests from forks
- Job tokens and their scope
- Short task: find a token leaking into logs and stop the leak
Runners
- Shared, dedicated and ephemeral runners
- Executors: shell, Docker and their risks
- Runner registration and matching jobs with tags
- Cleaning up between jobs: leftover files and caches
- Short task: audit which jobs a runner can run
Branches and deployment
- Protected branches and protected environments
- An approval step for production deploys
- Pipeline audit logs: who triggered what
- Capstone: harden a team’s pipeline for secrets and privileges
Practice labs
- Read the stages and jobs of a pipeline file: Mark the trigger, stages, jobs and artefacts in a pipeline configuration.
- Find the jobs that touch secrets: List the jobs that use secret variables in the pipeline file and the branches they run on.
- Map the pipeline’s attack surface and fix the weakest point: Work out who can trigger it, which external sources are pulled and which job reaches production, then fix and run the riskiest point.
- Make a CI variable protected and masked: Convert an openly defined deploy password to a protected, masked variable and show it is starred out in the log.
- Find a token leaking into logs and stop the leak: Find in job logs a token that bypasses masking through debug output and an encoded form, fix the command and rotate the token.
- Close the risk from outside contributions and the job token: Show fork requests can reach secret variables, turn that off, reduce the projects the job token may access to an allowlist and test it.
- List the runners by type and tag: Tabulate shared, dedicated and ephemeral runners with their executor and tags.
- Audit which jobs a runner can run: Find that the production-tagged runner accepts jobs from unprotected branches, make the runner protected and fix the tag matching.
- Clean up the files and cache left between jobs: Show on a shell-executor runner that one job can read the previous job’s files, move to the Docker executor and separate caches per branch.
- Make the main branch and production environment protected: Turn on protection and show the developer role cannot start the production deploy job.
- Add an approval step to production deploys: Make the deploy job manually triggered with an authorised approval and test that it does not run without it.
- Work out from pipeline audit logs who triggered what: Extract production deploys, who triggered them and variable changes from a week of logs and find the run nobody can explain.
- Assess the team’s pipeline against a security checklist: Tick ten items on secrets, runners, branches and approvals by examining the pipeline.
- Rank the findings by risk and write a fix plan: Set impact, effort and order for six findings and write steps that can be applied without stopping the pipeline.
- Harden a team’s pipeline for secrets and privileges: In Ilgıntepe Tekstil’s pipeline protect the variables, separate the runner, add deploy approval and prove each measure with a failed attempt.
About this course
You learn how a continuous integration pipeline works and where it carries secrets and privileges, and you set up pipeline files, runners and tokens safely.
What you will learn
- Getting to know the pipeline
- Secret variables
- Runners
- Branches and deployment
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.