CI/CD security covers two things: protecting the pipeline itself, and using the pipeline to enforce security on the code that passes through it. A secure pipeline controls who can change it, keeps its secrets safe, and blocks code that fails security or policy checks.
The second part is where infrastructure code governance fits. Ansible Playbooks and Terraform plans change real systems, so the pipeline should verify them before any deployment step. Steampunk Spotter runs as a part of CICD and fails the job when a Playbook or plan breaks a policy.
CI/CD security checklist
- Require reviews and branch protection on pipeline definitions.
- Store secrets in a vault, never in code or pipeline variables in plain text.
- Pin third-party actions, images and dependencies to exact versions.
- Gate merges on security and policy checks for application and infrastructure code.
- Keep audit logs of who changed what and when.
