Harden CI/CD pipelines with secret management, runner isolation, and artifact verification.
npx skills add https://github.com/thesammykins/dotfiles --skill cicd-security
Please help me install this Agent Skill. Skill: cicd-security Source: https://github.com/thesammykins/dotfiles/tree/main/.agents/skills/cicd-security Command: npx skills add https://github.com/thesammykins/dotfiles --skill cicd-security
CI/CD pipelines frequently suffer from insecure secret handling, weak supply chain controls, non-isolated runners, and unverified artifacts, which together heighten risk across builds and deployments.
Enable least-privilege CI identities, enforce secrets management, and isolate runners within your pipeline.
High-intent search queries and answers about installing and using this skill.
To harden secrets in GitHub Actions, you configure least-privilege CI identities and enforce managed secret stores to handle secrets management and rotation across CI configurations and logs, preventing credential leakage.
Runner isolation secures CI/CD pipelines by using ephemeral environments and restricted network access for build agents. This minimizes the attack surface by ensuring runners are temporary and isolated from unauthorized network traffic.
You implement supply chain integrity by configuring artifact signing and provenance checks within your pipeline. This verifies artifact origin and enforces secure supply chain governance across the build lifecycle.
Yes, this CI/CD security hardening applies to GitHub Actions, GitLab CI, Jenkins, and other CI systems. It standardizes least-privilege access, managed secrets, and runner isolation across diverse pipeline configurations.
The best way to prevent unauthorized deployments is enforcing least-privilege CI identities and isolating runners. This restricts deployment capabilities and secures the pipeline against unauthorized access attempts.
You need ephemeral runners to secure CI/CD pipelines because they provide isolated, temporary environments that restrict network access. This prevents persistent vulnerabilities and limits potential supply chain attacks.
bipinksIntegrate Vault, AWS Secrets Manager, and Kubernetes External Secrets for credential management.
a-ng-dValidate GitLab attestations for artifact provenance and integrity.
hardw00tSimulate attacker techniques across internal networks and Active Directory environments.
Muath2000Analyze software supply chain risks and generate SBOMs.
