Supply Chain Security

Supply chain security protects the path from source code to production. It covers contributors, dependencies, CI/CD, artifacts, provenance, and runtime verification.

Supply chain path

Controls

Important controls include:

• Branch protection and required reviews.
• Signed commits or verified identities where required.
• Least-privilege CI/CD permissions.
• OIDC federation instead of long-lived CI secrets.
• Dependency pinning and lockfiles.
• SBOM generation.
• Artifact signing and provenance attestations.
• Registry access controls.
• Deployment admission checks for trusted artifacts.

Artifact requirements

Production artifacts should record:

• Source repository and commit.
• Build workflow and run ID.
• Builder identity.
• Dependency or SBOM metadata.
• Digest or immutable version.
• Scan results.
• Signature or attestation where required.

Watchouts

• CI systems are production infrastructure.
• Third-party actions and plugins can execute privileged code.
• Long-lived registry or cloud keys in CI are high-impact secrets.
• Rebuilding per environment weakens traceability.
• Signing without verification is security theater.