Since lesson 3.7.6, the Kladde's pipeline can deliver all the way to prod. That makes it the most valuable target in the whole project: whoever
gets it to run their code no longer needs access to Azure, they get it from the pipeline. In the first half of this
lesson you close the usual doors and write the Kladde's rules as tests that run on every pull request. In the second
half you measure how healthy and how fast the pipeline is.
Three doors into a pipeline
Almost every attack on a pipeline comes through one of three doors:
| Door | Example | The Kladde's answer |
|---|---|---|
| Foreign code | A pull request from a fork changes a test, a script or a .props file |
foreign code never runs with write permissions or secrets |
| Foreign building blocks | An action or a package is hijacked (lesson 3.7.1) | actions pinned to a commit, Dependabot and NuGet Audit (lesson 3.7.3) |
| Foreign text | A title, a branch name or a commit message ends up in a script | text from the event reaches a script only as an environment variable |
What an attacker looks for in a pipeline is always the same: a token with write permissions, a secret, a sign-in to Azure, or a cache that a later run with permissions restores. Each section of this lesson takes one of these away from them.