GitHub Actions

Strategies for integrating software supply chain security in CI/CD pipelines. Covers build integrity, artifact signing, and provenance.

PO.3.1: "Specify which tools or tool types must or should be included in each toolchain to mitigate identified risks." PS.1.1: "Store all forms of code in a code repository that provides version control." PW.4.1: "Acquire and maintain well-secured software components from commercial, open source, and other third-party developers." GitHub Actions implements SSDF through automated security workflows.

NIST SP 800-161r1 §2.2: "Cybersecurity risks throughout the supply chain refer to the potential for harm or compromise that arises from cybersecurity risks posed by suppliers, their supply chains, their products, or their services." §3.4: "Enterprises should examine and validate software development processes, including configuration management processes, building on the SSDF." GitHub Actions workflows represent critical supply chain attack surfaces requiring C-SCRM controls.

Official security best practices for Actions workflows. Covers secrets management, permissions, third-party actions vetting, script injection prevention, and OpenID Connect authentication.

Common CI/CD security risks. GitHub Actions mitigations for poisoned pipeline execution, credential theft, and dependency confusion.

SOC 2 CC8.1: "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives." GitHub Actions workflows automate the authorization, testing, and approval of changes through required status checks and branch protection rules, directly implementing CC8.1 change management controls. Source: AICPA Trust Services Criteria.

ISO 27001:2022 A.8.25: "Rules for the secure development of software and systems shall be established and applied to developments within the organisation." GitHub Actions enables enforcement of secure development practices through automated security scanning, dependency review, and quality gates in CI/CD pipelines. Source: ISO/IEC 27001:2022 Annex A.

ISO 27001:2022 A.8.31: "Development, testing and production environments shall be separated and secured." GitHub Actions environments feature supports separation of deployment stages with environment protection rules, required reviewers, and deployment branches, implementing A.8.31 environment segregation requirements. Source: ISO/IEC 27001:2022 Annex A.