Draft Recommendations for Securing SaaS CI/CD Platforms
Opened this issue · 1 comments
tohch4 commented
As a Flexion engineer, in order to be confident in the sanity and safety of my build artifacts and related data, I would like guidance on how to properly configure SaaS CI/CD platforms, including, but not exclusively limited to:
- Github Actions
- CircleCI
- Travis
tohch4 commented
As discussed in November 5, 2020 Security Guild, we should look into guidance on:
- Github Actions itself and potentially:
- secrets storage
- secure command syntax in their YAML specification
- ancillary services:
- Github Container Registry
- Github Registry (for package manager for language runtimes)
- Github Storage
- CircleCI
- Travis