Hardening CI/CD: isolation, OIDC and pinned dependencies
You isolate runners between jobs, replace long-lived keys with short-lived OIDC identities, pin third-party actions and protect the pipeline itself against tampering.
Level 301 · 16 lessons · 15 practice labs
Lessons
Runner isolation
- A fresh runner for every job
- Narrowing the runner’s network access
- Hardening the runner host
- Short task: replace a persistent runner with an ephemeral one
Short-lived identity
- Job identity with OIDC: claims and audience
- The trust policy: which branch, which environment
- Getting secrets from Vault with OIDC
- Removing static keys and tracking the migration
- Short task: move a deploy job from a static password to OIDC
Pipeline integrity
- Pinning third-party actions and templates by hash
- Protecting shared pipeline templates
- Mandatory review for pipeline file changes
- Artefact integrity: hashes and signatures
- Short task: pin every external dependency in a pipeline
Review
- A pipeline security checklist: the OWASP Top 10 CI/CD risks
- Capstone: harden an organisation’s build pipeline against the checklist
Practice labs
- Test whether the runner carries state between jobs: Leave a file in one job, look for it in the next and state whether the runner is persistent or ephemeral.
- Replace a persistent runner with an ephemeral one: Register a runner that creates a fresh environment per job, remove the old one and verify nothing is left behind.
- Narrow the runner’s network access and harden its host: Allow the runner out only to the Git server, registry and package mirror, cut access to the internal network and close unneeded services on its host.
- Read the claims in a job identity token: Decode the OIDC token and write the project, branch, environment and audience claims.
- Move a deploy job from a static password to OIDC: Define a role in Vault that accepts the job identity, change the job to fetch short-lived credentials and delete the static variable.
- Narrow the trust policy by branch and environment: Find the loose policy letting any branch obtain production secrets, bind it to the protected branch and production environment only and show a feature branch is refused.
- Inventory the static keys in the pipelines: Scan the CI variables of all projects and list long-lived keys with owner and age.
- Prepare a table that tracks the migration: Write target method, owner and status for each static key and add a script that calculates the remaining count from the API.
- Remove the last static key without downtime and prevent regression: Run both methods side by side for a while, revoke the old one and add a pipeline check that catches any new static key.
- Find the unpinned external dependencies in a pipeline file: List the templates, images and scripts pulled by tag or branch name.
- Pin every external dependency in a pipeline: Convert templates to commit hashes and images to digests, and verify a downloaded script with its checksum.
- Protect shared templates and pipeline file changes: Add branch protection and owner approval to the template repository, require review for pipeline file changes and verify the artefact’s hash between stages.
- Map findings to the OWASP Top 10 CI/CD risks: Place eight sample findings under the right risk heading.
- Audit a build pipeline against the checklist: Examine the pipeline for each of the ten risks and write the status and evidence.
- Harden an organisation’s build pipeline against the checklist: Close the five gravest findings in Demirsu Enerji’s pipeline and report before and after evidence and residual risk for each.
About this course
You isolate runners between jobs, replace long-lived keys with short-lived OIDC identities, pin third-party actions and protect the pipeline itself against tampering.
What you will learn
- Runner isolation
- Short-lived identity
- Pipeline integrity
- Review
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.