tag: Supply-Chain-Security · 15 items
- Platform/SRE — Skip
- CI/CD — Plan: New GA capabilities in GitHub secret scanning—validity checks, dismissals, API, and webhooks—are worth integrating this quarter to automate triage and response when pipeline credentials or tokens are exposed in public repos.
- Leader — Learn: GitHub’s expanded secret-monitoring surface (validity checks, webhooks, API) shapes how orgs can build automated security workflows around leaked credentials, but no licensing, pricing, or vendor-risk decision is triggered.
- Platform/SRE — Skip
- CI/CD — Learn: A pre-GA feature that intercepts malicious packages at install time on CI runners — worth monitoring for GA so you can evaluate it as a supply-chain hardening layer in your pipelines.
- Leader — Learn: Signals maturing vendor-side tooling for supply-chain defense at the package layer; worth tracking as it approaches GA to assess whether it fits your org’s hardening roadmap.
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: GitLab Secrets Manager is now GA in 19.5 Premium/Ultimate, built on OpenBao — evaluate whether it can replace a standalone Vault deployment for GitLab-centric orgs, since it reuses the existing GitLab permission model and eliminates the sync-drift problem between vault access and project membership.
- CI/CD — Plan: Now GA in GitLab 19.5 — schedule evaluation of Secrets Manager as a replacement for unscoped CI/CD variables; it scopes credentials to individual jobs and attaches pipeline and job IDs to every credential read, making this a concrete supply-chain hardening step for GitLab-hosted pipelines.
- Leader — Learn: For orgs standardized on GitLab, this GA release shifts the build-vs-buy calculus on maintaining a separate secrets vault; no urgent vendor or licensing decision, but worth tracking as a potential toolchain consolidation as the feature matures on Dedicated.
- Signals: GitLab 19.5 EOL 2027-01-21 · GA announcement
- Platform/SRE — Learn: Improved secret detection in GitHub repositories is a useful security capability, but it has no operational change or deadline for infrastructure teams to act on.
- CI/CD — Plan: Evaluate enabling the new context-aware secret scanning model in GitHub Advanced Security to strengthen supply-chain hygiene; no hard deadline, but worth scheduling as part of a supply-chain hardening quarter.
- Leader — Learn: GitHub’s investment in AI-driven secret detection signals maturing supply-chain security tooling, worth factoring into security posture reviews, but no pricing, licensing, or strategic decision is triggered.
- Platform/SRE — Skip
- CI/CD — Learn: If your pipelines or repos use Supabase or Lovable credentials, GitHub will now automatically flag exposed tokens — no pipeline changes required, but worth knowing so teams understand why new alerts may surface.
- Leader — Skip
- Platform/SRE — Learn: A new GA GitHub Enterprise Cloud governance control that tightens human access to sensitive org actions; no infrastructure change required, but worth understanding when designing access-control policies.
- CI/CD — Plan: Evaluate which release and deployment actions qualify as high-impact in your org and whether enabling proof-of-presence would require changes to release-approval workflows; no deadline, but this is a concrete supply-chain hardening step to schedule this quarter.
- Leader — Plan: Evaluate rolling out proof-of-presence as an org-wide GitHub Enterprise Cloud policy to reduce insider-threat and account-takeover risk on sensitive actions; no deadline, but a meaningful security governance improvement to bring into your next planning cycle.
- Platform/SRE — Skip
- CI/CD — Learn: A full exportable inventory of SSH keys, PATs, and OAuth tokens touching the enterprise is useful context for supply-chain hygiene thinking, but it introduces no pipeline mechanic to change today.
- Leader — Plan: Schedule a review of GitHub Enterprise credential inventory exports as part of your next access-review or compliance cycle; the capability directly supports audit readiness for SOC 2 / ISO 27001 controls around privileged access.
- Platform/SRE — Skip
- CI/CD — Plan: Workflow execution protections are now GA for GitHub Enterprise, orgs, and repos; schedule adoption of allowlist controls to restrict who can trigger workflows as a supply-chain hardening step this quarter.
- Leader — Plan: This GA feature enables org-wide policy on who may trigger GitHub Actions workflows; evaluate adding it to your golden-path security standards and internal developer platform requirements.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: npm now applies a 72-hour security hold to any account following a recovery-code sign-in, broadening a protection previously limited to high-impact accounts; no pipeline changes are needed since CI automation should use tokens, not recovery codes, but this informs npm supply-chain security posture.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub capability lets teams enforce secret-blocking via repository rulesets; schedule a rollout to enable this across all repos as a supply-chain hardening step this quarter.
- Leader — Plan: This is a concrete org-wide policy lever — evaluate mandating the new secret-blocking ruleset as a standard across all GitHub repositories to reduce credential-leak risk at the merge gate.
- Platform/SRE — Skip
- CI/CD — Learn: Illustrates a prompt-injection attack vector where malicious repo content hijacks an AI agent’s pre-approved command scope; informs how to think about sandboxing agent-assisted pipeline steps, but no deadline or active exploit anchor.
- Leader — Learn: Useful framing for setting policy on where and how AI coding agents are permitted to run in the development workflow, particularly around isolation boundaries — but no decision is forced today.
- Platform/SRE — Skip
- CI/CD — Plan: Teams that publish npm packages via their release pipelines should review the new dual-use metadata requirement to ensure compliance before enforcement begins; no hard deadline surfaced in the item, so schedule this in the next pipeline audit cycle.
- Leader — Learn: npm’s automated publish-time scanning strengthens the ecosystem’s supply-chain posture; worth noting as a positive signal when reviewing org-wide software supply-chain policy, but no leadership decision is required now.
- Platform/SRE — Skip
- CI/CD — Learn: Vendor-authored post highlighting how AI coding agents can leak credentials into build/deploy contexts; worth evaluating your secret isolation controls if agents touch pipelines, but no concrete deadline or confirmed compromise here.
- Leader — Learn: Surfaces a real risk category—AI agent access to secrets in the software supply chain—worth factoring into your AI tooling policy and golden-path standards, though this is Docker marketing with no specific incident or actionable deadline.
- Platform/SRE — Skip
- CI/CD — Learn: Beta feature that auto-opens MRs to patch vulnerable dependencies and iterates until the pipeline passes — worth evaluating once GA, but pre-GA status caps this at Learn for now.
- Leader — Learn: Beta capability targeting the OWASP dependency backlog and compliance remediation windows (PCI-DSS/FedRAMP 30-day deadlines); monitor for GA before considering for the golden path.
- Signals: breaking-change flagged
- Platform/SRE — Skip
- CI/CD — Plan: New GA endpoints let teams manage secret scanning custom patterns as code, enabling IaC-style enforcement of scanning policies across repos; schedule adoption as part of supply-chain hardening this quarter.
- Leader — Skip
- Signals: GA announcement