<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Build Pipeline Integrity — API Reference

## GitHub Actions Security

```bash
# List self-hosted runners
gh api repos/{owner}/{repo}/actions/runners --jq '.runners[]'

# List organization runner groups
gh api orgs/{org}/actions/runner-groups --jq '.runner_groups[]'

# List workflow runs
gh run list --limit 50 --json status,conclusion,name,headBranch

# View workflow permissions
gh api repos/{owner}/{repo}/actions/permissions --jq '.'

# Check OIDC configuration
gh api repos/{owner}/{repo}/actions/oidc/customization/sub --jq '.'
```

## Pipeline Injection Prevention

```yaml
# VULNERABLE — expression in run step
- run: echo "${{ github.event.pull_request.title }}"

# SAFE — use environment variable
- run: echo "$TITLE"
  env:
    TITLE: ${{ github.event.pull_request.title }}

# SAFE — use action input
- uses: my-action@sha
  with:
    title: ${{ github.event.pull_request.title }}
```

## Action Pinning

```bash
# Pin action to SHA
# BEFORE (unpinned):
# uses: actions/checkout@v4
# AFTER (pinned):
# uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

# Use step-security/secure-workflows to auto-pin
npx step-security/secure-workflows
```

## StepSecurity Harden-Runner

```yaml
- uses: step-security/harden-runner@v2
  with:
    egress-policy: audit    # or 'block'
    allowed-endpoints: >
      github.com:443
      api.github.com:443
      ghcr.io:443
```

## GitLab CI Security

```yaml
# Restrict runner tags
job:
  tags:
    - protected-runner
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Protected environments
deploy:
  environment:
    name: production
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
```

## SLSA Build Requirements Checklist

| Requirement | L1 | L2 | L3 |
|-------------|----|----|-----|
| Automated build | ✓ | ✓ | ✓ |
| Hosted build service | | ✓ | ✓ |
| Build as code | | ✓ | ✓ |
| Ephemeral environment | | | ✓ |
| Isolated build | | | ✓ |
| Parameterless | | | ✓ |
| Hermetic | | | ✓ |
