A useful CI/CD audit follows a change from its first pull request through build, test, packaging, and deployment, then checks who and what can influence each step. Start by mapping that route across repositories and environments; next inspect pull-request safeguards, access and secrets, third-party components, artifact integrity, release approvals, and evidence. This end-to-end view matters because the pipeline is part of the software supply chain, not just a way to run tests. NIST’s SP 800-204D, published February 12, 2024, addresses integrating software-supply-chain security measures into DevSecOps CI/CD pipelines.
What should I audit in my CI/CD pipeline?
Audit the whole route from source to production: workflow definitions, CI services, runners, build environments, artifact registries, deployment targets, and the people or systems with authority at each point. CI means continuous integration; CD can mean continuous delivery or continuous deployment. OWASP distinguishes the two: continuous delivery leaves the production push manual, while continuous deployment automates it. Include the production handoff that actually applies to your team rather than assuming every pipeline deploys automatically. The NIST guidance treats build, test, package, and deploy operations as connected stages.
The central question is whether an untrusted change, compromised component, or over-privileged job could alter a release or gain access it should not have. OWASP’s CI/CD Security Cheat Sheet puts the risk plainly: “The pipeline that builds and ships your software is itself a high-value target.”
How do I map the pipeline before checking controls?
Choose a representative change and trace it from pull request to production, including reusable workflows and external services. Record where each transition happens, who owns it, and what artifact or identity crosses it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- List repositories, workflow definitions, CI services, runner types, build images, registries, deployment environments, and accountable owners.
- For each repository, note which jobs run for internal pull requests, fork contributions, tags, scheduled workflows, and manual releases.
- Mark where code or workflow configuration can be changed, where secrets become available, and which steps can publish or deploy.
- Follow one built artifact into its registry and deployment target; note what identifies it and how the deployed version can be tied back to its source and build.
Capture exceptions and alternate paths as part of the map. A release path that bypasses the normal pull-request workflow is still part of the system being audited.
Do pull requests validate changes without giving untrusted code too much power?
For each change path, check whether automated validation covers the artifacts changed by the pull request. NIST’s SP 800-204D gives examples including unit tests, linters, integrity tests, and security checks. Confirm that the relevant checks actually run and that a failure cannot be bypassed silently.
Inspect who can approve workflow changes and what happens when a contribution comes from a fork or another untrusted source. NIST recommends repository protections that delay CI workflow runs until approval by a maintainer with write access. Translate that recommendation into controls your platform supports and your threat model requires; do not assume one setting fits every repository. In particular, establish whether untrusted code can execute with sensitive permissions or reach secrets before an appropriate approval.
Rank #2
Which identities, permissions, and secrets can each job use?
Make an access map at the job level, not just a list of organization-wide credentials. OWASP calls for least privilege across pipeline access controls, step secrets, connected resources, and the operating-system identity used to run a job. For each job, record what it can read, change, publish, or deploy.
- Review repository and organization permissions, cloud roles, deployment credentials, package-publishing tokens, and secrets exposed to the job.
- Check whether each job receives only the access it needs and whether a less-trusted job can influence a later, more-privileged job.
- Where the platform supports it, assess whether credentials can be short-lived instead of long-lived.
- Inspect the runner’s operating-system user and the isolation between jobs, particularly when runners are reused or handle sensitive environments.
Document the reason for exceptions and who owns them. The goal is to make unnecessary access visible and reduce the consequences if a job or its inputs are compromised.
How are third-party workflow components and runners controlled?
Inventory external workflow actions, plugins, templates, build images, and tools. For each, record how its version is selected, who reviews changes or updates, and what access it receives when it runs. Check whether a component can alter build output, access secrets, or reach deployment resources beyond what its task requires.
Rank #3
Review runner trust alongside component trust: determine whether execution is isolated from other jobs and sensitive environments, and whether a job can leave behind state that affects a later run. OWASP’s DevSecOps guideline specifically calls out auditing third-party Actions and pipeline access risks. Set any version-pinning or update target as an organization policy, and report how you measured it; there is no universal percentage established here as a standard.
Can you verify that the deployed artifact came from an approved build?
Trace a release artifact from its source and build through the registry to the deployed environment. Check how the organization distinguishes approved artifacts from untrusted ones, records which source and build produced each artifact, and verifies provenance or attestations when used. NIST SP 800-204D identifies provenance, attestations, and software bills of materials (SBOMs) as relevant supply-chain concepts.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSeparate producing evidence from enforcing policy: a system may generate an attestation or SBOM, but the release process must also decide whether that evidence meets the conditions for deployment. The right depth depends on the organization’s risk and release model; the audit should establish what evidence exists and whether the release path checks it.
What should production approval and recovery evidence show?
For production releases, record which changes require approval, how exceptions are authorized, and what evidence links the deployed artifact to reviewed source and its build. Inspect audit logs and the evidence for a recent release path to see whether the documented process can be reconstructed in practice.
Set log-retention periods and approval rules through your organization’s policy and risk requirements. The cited guidance does not establish one required retention period or a universal approval model, so an audit should report the organization’s chosen rule and whether it is followed rather than inventing a single correct number.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I rank and track the findings?
For every finding, record the affected repositories and release paths, the risk, supporting evidence, an accountable owner, a remediation action, and a due date. Rank work by potential risk reduction, reduction in blast radius, improvement in artifact traceability, and rollout effort. These criteria help distinguish a broad control that prevents unauthorized workflow execution from a lower-impact cleanup, without pretending to be a product ranking or an industry benchmark.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTrack remediation and approved exceptions across the repository portfolio so teams can see whether a control is consistently applied or limited to selected projects. Prioritize gaps that permit unauthorized workflow execution, excessive access, or artifact tampering.
When are scanning tools useful?
Tools can help teams assess workflow configuration or gain visibility across repositories, but they do not replace the end-to-end review or prove a release is safe. OWASP’s living DevSecOps guideline names open-source options such as OpenSSF Scorecard and zizmor, as well as commercial pipeline-security posture examples Cycode and Legit Security. Treat these as examples, not a comparative ranking or endorsement; their usefulness depends on the repositories and risks you need to cover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
