Securing built-in CI/CD tools
Each major SCM has its own native CI/CD tool. There are GitHub Actions, GitLab CI/CD, and Bitbucket Pipelines, to name a few. Let’s look at a few high-level concerns to consider.
Be sure and intentional about "which" does "what"
Continous integration and continuous delivery (CI/CD) are two different pipelines. CI brings all the pieces together and builds and tests the artifacts. All the SAST, DAST, SCA, secrets scanning, and so on can be done in the CI pipeline, but can also be triggered by hooks and run before commits or to inspect pull requests before merging.
CD is intended to deploy the artifacts built in CI. They can be delivered to production or a testbed/staging environment. Some companies employ a green/blue method in which the last good deployment is demoted to the blue (backup) environment while the new artifacts are deployed to green (production). Should the latest code fail, the system can switch over to...
