Module 04 · Source and pipeline · 60 min · You are: Platform team
Borrowed code
In this module
- You learn: Treat actions, packages, scanners and build tools as code you inherit.
- You do: Inspect the local Verdaccio exercise, observe the seeded dependency and token, pin actions by full commit, verify package signatures and set a release cooldown.
- You end with: S04 records pinned workflow dependencies, a lockfile and a consumer policy that rejects a fresh package.
A security scanner is also borrowed code. A mutable tag or publishing token can turn a trusted check into a delivery path.
Open this module in the interactive course to track progress.
Change journey practised: Surface → Test → Measure → Prove
Concepts
- Surface: action and package publishers
- The sample package registry is local and uses disposable lab data.
- Trust boundary
- A lockfile fixes resolution but does not prove the publisher is safe.
- Evidence
- Break it: a tag moves to a different commit
Files to know
Open them in your editor or on GitHub; the bullets say what to look at.
start/.github/workflows/ci.yml(reference): Course reference file for this surface.- This is the control or seeded condition examined in this module. L6
start/docs/dependency-policy.md(reference): The small lab fixture used for a bounded test.- This fixture makes the trust assumption visible. L5
Steps
1. Test: inspect what the build trusts
Review the exact action commits, the package lock and the local registry log. The Verdaccio exercise is bound to 127.0.0.1 and must contain no public publish step.
cd devsecops-lab && docker compose -f labs/registry/compose.yaml up -d
The local registry listens only on localhost:4873. Stop it after the exercise.
cd devsecops-lab/app && npm audit signatures --registry=http://localhost:4873
2. Measure and prove: delay and constrain packages
Pin actions to full commit ids, keep the lockfile, set a release cooldown, remove publish credentials, block install scripts and reject a package newer than your chosen minimum age. Record S04.
cd devsecops-lab && zizmor .github/workflows/
Check that no action is referenced by a movable tag and that no job has NPM_TOKEN.
cd devsecops-lab && docker compose -f labs/registry/compose.yaml down
Simplified for the workshop
The reference repository is a local learning fixture. Canaries, package publishing and service endpoints are disposable and do not grant access to a real account.
The checks read repository files as data. They do not run learner scripts or install dependencies.
Break it on purpose: Evidence is a repeatable test result tied to an owner, commit and retest.
A teammate makes a small change to save time. Work out which trust assumption it changes before you run the test.
You practise: You practise tracing the cheapest path from an input to a capability and identifying an independent control.
1. Break it
cd devsecops-lab && git diff -- .github/ docs/
2. What you see
Expected: the proof is stopped at the intended boundary. You get a successful path or missing evidence. Read the workflow log and the register entry.
3. Fix it yourself
Restore the intended boundary and rerun the same test. Done when the unsafe path is refused, the evidence is recorded and the files pass the repository validator.
Hint 1
Name who controls the input and what privilege consumes it.
Hint 2
Follow the input to the first capability and remove that trust or privilege.
The fix
Use the test and the exact policy file named above; do not add a blanket permission.
cd devsecops-lab && ./scripts/validate.sh
After you fixed it: the five questions
- What failed?
- A trust boundary allowed untrusted input to reach a useful capability.
- How was it detected?
- The predicted result and observed log did not match; preserve the commit and workflow run as evidence.
- Who responds?
- The owner listed for this surface in docs/attack-surface.yaml.
- How is it corrected?
- Close the specific boundary and repeat the original test.
- How is it prevented?
- Keep a parse-only lab check and a review rule on the owning files.
Quiz
- Which question best identifies the cheapest path?
- Which accepted input reaches the most useful capability with the fewest prerequisites?
- Which scanner has the most findings?
- Which team owns the largest number of files?
- What does a passing signature prove?
- The named identity signed these bytes.
- The source code is harmless.
- The image has no known vulnerabilities.
- When is a surface covered?
- The same bounded test is refused and evidence names the control and owner.
- A scanner has no critical findings.
- A policy file exists in the repository.
Answers
- Which accepted input reaches the most useful capability with the fewest prerequisites? Attack paths follow trust and capability, not tool counts.
- The named identity signed these bytes. Signatures bind identity and bytes, not safety.
- The same bounded test is refused and evidence names the control and owner. Presence is not proof; retest the attack path.
Field note
I ask learners to write the expected signal before they run a test. It makes a control failure easier to tell from a test that never reached the boundary.