maxtac-supply-chain-cicd-release-takeover

A CI/CD release takeover vulnerability occurs when untrusted workflow input reaches trusted release, signing, or deployment authority. This analysis traces compromise paths through triggers, jobs, dependencies, artifacts, caches, environments, tokens, and external services.

To analyze CI/CD workflows for supply chain security, trace untrusted CI input paths to high-trust authority. This skill evaluates workflow triggers, runner labels, OIDC federation, artifact promotion, and deployment sequences to detect potential compromise exploit paths.

Yes, you can detect high-risk patterns like mutable action refs, compromised third-party actions, and OIDC federation issues. The analysis evaluates branch protection, environment approvals, and artifact verification as controls and counterevidence against release takeover.

Yes, this supply chain analysis requires the MaxTAC CI/CD Release Takeover tool to evaluate advanced CI/CD workflows. It focuses on runner, cache, OIDC, publishing, signing, artifact promotion, and deployment takeover analysis.

Controls evaluated to prevent CI/CD release takeover include branch protection, environment approvals, and artifact verification. The analysis assesses these counterevidence mechanisms against exploit sequences involving untrusted inputs reaching signing or deployment authority.