skills.rest
ConnectiveTCS
ConnectiveTCSCOMMUNITY
Explore all skills by this author →
GitHub

CI/CD Pipeline Security Expert

Enforce least privilege, secret management, and supply chain protections in CI/CD pipelines.

Updated Apr 5, 2026
Search Tags:#security#supply-chain#github-actions#ci-cd#sbom#secret-management#code-signing
One-click install
npx skills add https://github.com/ConnectiveTCS/Gradient_Generator --skill ci-cd-pipeline-security-expert-connectivetcs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: CI/CD Pipeline Security Expert
Source: https://github.com/ConnectiveTCS/Gradient_Generator/tree/main/.agents/skills/ci-cd-pipeline-security-expert
Command: npx skills add https://github.com/ConnectiveTCS/Gradient_Generator --skill ci-cd-pipeline-security-expert-connectivetcs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

CI/CD pipelines often expose secrets, signing keys, and deployment credentials, creating a high-value target for supply-chain attacks. This skill provides a structured approach to design and enforce security controls across the CI/CD lifecycle, including secret management, artifact signing, SBOM generation, and governance of GitHub Actions workflows.

Core Features & Use Cases

  • Secret management with proper scoping and rotation.
  • Code signing and notarization across Windows, macOS, Linux.
  • Artifact security including SBOM generation and attestation.
  • Supply chain protection against dependency attacks.
  • GitHub Actions security best practices including explicit permissions, OIDC usage, and risk reduction.

Quick Start

Start by defining a secure GitHub Actions workflow with least-privilege permissions, SHA-pinned actions, and environment-scoped secrets to begin protecting your CI/CD pipeline.

Frequently Asked Questions about CI/CD Pipeline Security Expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure secrets and manage permissions in GitHub Actions workflows?▼

Securing GitHub Actions involves enforcing least-privilege permissions, scoping environment secrets, and using OIDC for keyless authentication. This approach minimizes exposure of deployment credentials and signing keys during CI/CD execution.

What is SHA pinning and how does it protect CI/CD supply chains?▼

SHA pinning locks GitHub Actions to a specific commit hash, preventing dependency confusion and supply-chain attacks. It ensures workflows execute trusted code by rejecting automatic updates from potentially compromised tags or branches.

How do I generate an SBOM and sign build artifacts in a CI/CD pipeline?▼

Generating an SBOM and signing artifacts involves creating a software bill of materials during the build process and applying code signing across Windows, macOS, and Linux. This provides attestation and verifies artifact integrity downstream.

Does this CI/CD security approach work for pipelines other than GitHub Actions?▼

Yes, the security practices apply to build, test, and deployment workflows across GitHub Actions and other CI systems. It standardizes secret management, artifact signing, and supply chain protections regardless of the platform.

What's the best way to prevent supply-chain attacks in CI/CD pipelines?▼

Preventing supply-chain attacks requires threat-model aware practices, explicit workflow permissions, and dependency protection. Enforcing least privilege and artifact attestation mitigates risks of compromised dependencies or stolen deployment credentials.

Related Skills

Explore More Software Engineering Skills→
barrydobsonbarrydobson

github-actions

Automate secure CI/CD pipelines with GitHub Actions workflows.

Community
Intermediate
RedHatProductSecurityRedHatProductSecurity
47

sbom-provenance

Generate SPDX and CycloneDX SBOMs with build provenance attestation.

Official
Intermediate
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced
zerAdazerAda

supply_chain_security

Sign Docker images with Cosign and generate SBOMs for supply chain security.

Community
Advanced