Cheat notes · Module 04 · Source and pipeline
Borrowed code
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Treat actions, packages, scanners and build tools as code you inherit. S04 records pinned workflow dependencies, a lockfile and a consumer policy that rejects a fresh package.
Remember
- Surface: The sample package registry is local and uses disposable lab data.
- Trust: A lockfile fixes resolution but does not prove the publisher is safe.
- Evidence: Break it: a tag moves to a different commit
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The sample package registry is local and uses disposable lab data.
What do you test?
Inspect the local Verdaccio exercise, observe the seeded dependency and token, pin actions by full commit, verify package signatures and set a release cooldown.
What proves the control holds?
S04 records pinned workflow dependencies, a lockfile and a consumer policy that rejects a fresh package.
Where module 04 leaves you: S04 records pinned workflow dependencies, a lockfile and a consumer policy that rejects a fresh package.