Pipeline field notes
Review the control, the path it stops and the evidence that proves it.
These pages are the same content as the interactive course, on one page per module, for reading and printing.
The evidence
| Piece | What it is |
|---|---|
| Attack surface register | Keep owner, test, controls, status and evidence together. |
| Attacker notebook | Record objective, trust, cheapest path, pivot and signal. |
Your setup
Commands in these notes use these values (shared with the interactive course, stored only in this browser).
Outline
| Module | Part | Time | You are | You will |
|---|---|---|---|---|
| 00 Orientation | Orientation | 25 min | Platform team | Create the learner repo, inspect the seeded app and workflows, and open docs/attack-surface.yaml. |
| 01 Secrets in Git | Source and pipeline | 35 min | Platform team | Run the repository scan, inspect the seeded canary rule and hook, remove the canary from history, rotate the lab value, and record S01. |
| 02 Workflows and artifacts | Source and pipeline | 60 min | Platform team | Test issue-title interpolation and the workflow_run report consumer, restrict permissions, treat artifacts as JSON data, and audit workflows with zizmor. |
| 03 AI agents in CI | Source and pipeline | 40 min | Platform team | Use the deterministic local stand-in against a harmless issue fixture, then remove its write access and secret, and validate its output in a model-free job. |
| 04 Borrowed code | Source and pipeline | 60 min | Platform team | Inspect the local Verdaccio exercise, observe the seeded dependency and token, pin actions by full commit, verify package signatures and set a release cooldown. |
| 05 Build a verifiable image | Artifact | 50 min | Platform team | Build checkout, scan its filesystem and image, publish a digest from a tagged release, and attach provenance to that digest. |
| 06 Verify at admission | Artifact | 55 min | Platform team | Sign the release digest with keyless identity, install the image policy, try a mismatched signer, and record S06. |
The change journey
- Surface: Find the trust boundary and the capability behind it.
- Test: Predict and run a bounded proof on your own repository.
- Measure: Put an owned control in code and commit it.
- Prove: Repeat the test and record evidence and residual risk.
Before using the pattern in production
- Identity: Pin actions and scope identities to the exact workflow.
- Secrets: Rotate exposed credentials and keep long-lived tokens out of build jobs.
- Evidence: Keep the hypothesis, log, commit and retest result.