Put software-supply-chain checks inside the CI/CD path

Bottom line: a deployment pipeline is not just an efficiency tool. It is a chain of privileged operations that converts source and dependencies into an artifact and then changes production. Security checks are strongest when they are part of those transitions and leave verifiable evidence.

Source fact: what NIST addresses

NIST SP 800-204D describes continuous integration and continuous deployment pipelines as flow processes that move software through stages such as build, test, package, and deploy. NIST treats these operations as part of the software supply chain and outlines strategies for integrating supply-chain security measures into CI/CD pipelines, particularly in cloud-native DevSecOps environments.

The source supports evaluating the path as a system rather than treating a source repository or final scanner as the whole supply chain.

What the source does not establish

The publication does not certify a pipeline product or define a universal set of mandatory tools. Automation does not establish integrity by itself: a fast, repeatable process can reproduce a compromised input or over-privileged change. A generated bill of materials, signature, or scan report is only useful when its origin, scope, verification, and decision role are understood.

Applicability depends on the development model, artifact types, deployment targets, supplier inputs, secrets, signing or attestation mechanisms, and the consequences of unauthorized or erroneous release.

Applicability questions

• Which sources, dependencies, build images, actions, plugins, and external services can influence the artifact?
• Which human and machine identities can change pipeline logic, approve promotion, publish artifacts, or deploy?
• What immutable information connects source, inputs, build execution, test results, artifact, and deployment?
• Which findings block movement, and who can approve a bounded exception?
• Can the organization stop, revoke, or roll back a release if the pipeline or an input is later questioned?

DSE recommendation: secure each transition

The following steps are DSE recommendations based on the cited source.

1. Diagram stages, trust boundaries, inputs, outputs, identities, stores, external calls, approvals, and production destinations. Include infrastructure-as-code and administrative pipelines.
2. Pin and review executable dependencies such as build images, pipeline actions, plugins, and package sources. Record authorized provenance and update ownership.
3. Use narrowly scoped automation identities and short-lived credentials where supported. Separate the ability to change the pipeline from the ability to approve or perform consequential promotion when risk warrants it.
4. Generate and protect evidence at each stage: source revision, resolved dependencies, build environment, test results, artifact digest, approval, promotion, and deployment result.
5. Verify artifacts when they cross a trust boundary. Define what happens when provenance, integrity, policy, or required evidence cannot be validated.
6. Rehearse containment: pause the path, revoke a credential or artifact, locate deployments, restore a known release, and preserve logs for investigation.

Verification and evidence

Trace one deployed release backward to an immutable artifact, build execution, exact source and dependencies, tests, policy decisions, identities, and approvals. Then sample a denied unapproved change and a rollback. Record any stage that depends on mutable labels, shared credentials, or evidence outside retention.

Official references

• NIST SP 800-204D — Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines — National Institute of Standards and Technology; published February 2024
• NIST SP 800-218 — Secure Software Development Framework — National Institute of Standards and Technology