CI and supply chain

Required

• Lock every CI action and its dependencies to a reviewed commit

  ENG-55

  Run every outside CI action, reusable workflow and template at a commit you reviewed, including the actions they call inside. A tag that moves must never change what runs.

• Keep untrusted text out of CI scripts

  ENG-41

  Never expand text that outsiders write straight into a CI script. Pass it in through an environment variable, and quote it.

• Run outside code only on runners that are wiped after each job

  ENG-56

  Never run jobs of a public repository on a self-hosted runner that keeps its disk between jobs. Give every job on your own machines a fresh runner that is removed when the job ends.

• Pass build secrets as mounts instead of layers

  ENG-69

  Give the build a token or key only through a secret mount. Never through ARG, ENV, or a copied file.

• Scan every image before it ships

  ENG-70

  Scan each built image for known holes in CI, and fail the build on high or critical ones that have a fix.

Recommended

• Pin every version so builds repeat

  ENG-21

  The same commit always gives the same build. Pin the language version, the tools and every dependency.

• Pin each base image by digest

  ENG-68

  Name every base image by version and digest, never by a moving tag such as latest. Choose the smallest image that runs the app.

• Build releases only in CI and verify them before deploy

  ENG-11

  Build every release in the CI service from a reviewed commit, with signed provenance. Deploy or publish only a build whose provenance names your repository.

• Make release tags and files immutable

  ENG-42

  Once a release is published, its tag never moves and its files never change. A fix ships as a new version.

• Build releases without a shared cache

  ENG-57

  Build every release from a clean install from the lock file. Never restore a cache in a release job that other workflows can write.

• Block pushes that contain secrets

  ENG-58

  Turn on the code host's secret push protection for every repository, so a push with a key is refused before it lands. Every bypass needs a reason and alerts an owner.

• Sign release tags and require verified commits on main

  ENG-59

  Sign every release tag. Require a verified signature on every commit that reaches the main branch, so a stolen password alone cannot add code under someone's name.