BCN-T3-PRC-002Tier 3 · Best PracticesProcessing Protection

CI/CD Pipeline Hardening

Build pipelines without dependency pinning, artefact signing, or runner isolation.

Remediation SLA: 90 days
Tier: 3 · Best Practices
Domain: Processing
Escalation: Reviewed at quarterly planning; may be formally deferred

What this finding is

The build pipeline lacks supply-chain controls: unpinned dependencies and actions, no lockfile enforcement, unsigned build artefacts, shared runners without isolation between jobs, or secrets available to workflows triggered by untrusted contributions.

Why it is Tier 3

The pipeline has production write access, which makes it a high-value target — compromising a build reaches every downstream consumer at once. These controls are Tier 3 rather than Tier 1 because they harden a system that should already be protected by access controls; where the pipeline's credentials are themselves exposed the finding is BCN-T1-IAM-003, and where its console is internet-reachable it is BCN-T1-PRC-002.

Most common misclassification

Exposed pipeline credentials found during this work are Tier 1 under BCN-T1-IAM-003 — do not fold them into the hardening item, which would delay rotation to a 90-day SLA.

How to detect it

1Check whether third-party actions and dependencies are pinned to immutable digests rather than to mutable tags.
2Determine whether build artefacts are signed and whether signatures are verified at deployment.
3Review runner isolation — shared runners permit one job to observe another's secrets.
4Identify workflows triggered by external contributions that have access to repository secrets.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Pin all external actions and dependencies to digests, and enforce lockfiles in CI.
2Sign build artefacts and verify signatures at deployment, so an unsigned artefact cannot reach production.
3Use ephemeral runners so each job starts from a known state and leaves nothing behind.
4Restrict secret access by workflow and branch, and deny secrets to workflows triggered by forks.
5Generate and retain a software bill of materials for each build.

How to verify the fix

A build with an unpinned dependency or an unsigned artefact fails the pipeline, runners are confirmed ephemeral, and a fork-triggered workflow cannot access repository secrets.