A useful CI/CD audit follows a change from its pull request through build, test, packaging and deployment, then checks who and what can influence each step. CI/CD means continuous integration and continuous delivery or deployment; the pipeline is part of your software supply chain, not just automation to keep builds moving. Start by mapping that path, then investigate untrusted changes, permissions, third-party components, artifact integrity and release evidence.
What should I audit in my CI/CD pipeline?
Audit the complete path that turns source code into a production release: repositories and workflow definitions, CI services and runners, build environments, artifact registries, deployment targets, and the people or services with authority at each point. NIST SP 800-204D, published February 12, 2024, describes strategies for integrating software supply-chain security into DevSecOps CI/CD pipelines. Its end-to-end perspective is a useful boundary for an audit: a control in one job is not enough if a later job or deployment identity can bypass it.
As an Amazon Associate I earn from qualifying purchases.
First establish what “delivery” means in your organization. In continuous delivery, code is prepared for production but a person manually pushes it there; in continuous deployment, that step is automated. OWASP makes this distinction in its CI/CD Security Cheat Sheet. It affects which approvals, identities and release controls you need to examine, but neither approach removes the need to know which source and build produced the deployed artifact.
“The pipeline that builds and ships your software is itself a high-value target.”
1. Map the pipeline and define the audit boundary
Choose a representative change and trace it from pull request to production. Include shared workflows and external services rather than stopping at the repository’s visible workflow file. The goal is to identify every place where a change, identity or artifact can gain influence over the release.
- Inventory repositories, workflow definitions, CI services, runners, build environments, artifact registries, deployment targets and responsible owners.
- Record which jobs run for internal branches, pull requests from forks, tags, scheduled jobs and manual releases.
- Trace reusable workflows, plugins, external actions, templates, build images, tools and connections to cloud or deployment services.
- Mark where source is checked out, code is built and tested, artifacts are stored, and deployments receive credentials or approval.
Use this map to set a repeatable boundary across repositories. If a shared workflow, runner pool or deployment role serves many projects, include that common component: its compromise or misconfiguration may affect more than one release path.
2. Check pull-request validation and untrusted contributions
For every relevant change path, check whether automated validation runs on the artifacts changed by the pull request. NIST SP 800-204D gives unit tests, linters, integrity tests and security checks as examples. A green status is useful only if the checks cover the change and the result is required before the change can proceed under your repository policy.
Rank #2
- Confirm which tests and checks run for application code, workflow changes, build configuration and other release-relevant files.
- Check whether required reviews or branch protections can be bypassed, and who is permitted to approve changes that alter workflow behavior.
- Determine whether a contribution from a fork or other untrusted source can run code with access to secrets, privileged tokens, internal resources or a trusted runner.
- Review how maintainer approval is applied before CI runs untrusted workflow changes with sensitive access.
NIST recommends repository protections that delay CI workflow runs until approval by a maintainer with write access. Translate that recommendation into the controls your platform offers and the threat model for each repository; do not assume every platform or project has the same approval setting.
For pull-request workflows, ask not only whether a job is labeled “test,” but also what permissions and environment it inherits. An attacker-controlled change can affect the commands a job runs; therefore, validation and privilege boundaries need to be considered together.
3. Review job identities, permissions and secrets
Build an access map job by job. Include the identity that runs the job, the permissions granted by the CI platform, credentials made available to steps, and access to connected services. OWASP’s guidance applies least privilege to pipeline-based access controls, step secrets, access to other resources and the operating-system user running the job.
Rank #3
- List repository and organization permissions, cloud roles, deployment credentials, package-publishing tokens and other secrets available to each job.
- Ask whether each job receives only the access it needs, and whether credentials can be short-lived where the platform supports that approach.
- Check whether less-trusted jobs can influence later privileged jobs, share writable workspaces or reuse a runner that handles sensitive work.
- Review the operating-system identity and permissions used inside each runner or build environment, not just the CI platform’s token settings.
- Trace where secrets are exposed to steps and whether logs or artifacts could reveal them.
Pay particular attention to transitions: a test job that consumes untrusted code should not silently pass control, writable files or credentials into a release job with publishing or deployment authority.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall4. Inventory third-party components and assess runner trust
External actions, plugins, templates, images and build tools are part of the executable pipeline. For each one, identify its source, version-selection method, update process and reviewer. Establish whether jobs are isolated from one another and from sensitive environments, especially when untrusted contributions are involved.
- List external workflow actions and other third-party components used in release paths.
- Determine who reviews new components and version updates, and how the organization decides when to upgrade.
- Check whether runners are isolated from other jobs and whether sensitive jobs use environments with appropriate trust boundaries.
- Record the organization’s approved versioning or pinning policy and how compliance with it is measured.
The OWASP DevSecOps Guideline on CI/CD pipeline security specifically calls out third-party Actions and pipeline access risks. It does not establish a universal pinning percentage; set a target appropriate to your risk and report the measurement method rather than treating an example target as an industry-wide standard.
5. Verify artifact integrity and release traceability
Follow a built artifact from the job that creates it into its registry and on to deployment. Determine how your organization distinguishes approved artifacts from untrusted ones, and whether it can connect a release to the source and build that produced it.
- Check what identifies the source revision, build process and artifact associated with a release.
- Review how artifacts are stored and selected for deployment, including how the release path prevents an unapproved artifact from being substituted.
- Where your organization uses provenance, attestations or software bills of materials (SBOMs), inspect how they are generated and what they describe.
- Determine whether release policy verifies that this evidence is present and acceptable, rather than merely confirming that evidence was generated.
NIST SP 800-204D discusses provenance, attestations and SBOMs as relevant supply-chain concepts. The appropriate depth depends on your risk and release model: the practical audit question is whether the evidence you rely on is tied to the artifact being deployed and checked against a defined policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Examine production approvals and recovery evidence
For each production release path, document which changes require approval, who can grant it, and how exceptions are recorded. Then review a recent release from its reviewed source through its build and deployment evidence. This tests whether your documented controls leave a usable trail in practice.
- Confirm that the deployed artifact can be traced to the reviewed source and build.
- Check that release approvals and exceptions are recorded in the systems your organization relies on.
- Review the available audit logs and release records for gaps that prevent reconstructing who or what authorized a deployment.
Retention periods and approval models are organization-specific policy decisions; the guidance cited here does not prescribe one universal duration or model. Set those requirements to fit your risk, operational needs and applicable obligations.
7. Rank findings and make the audit actionable
A finding should tell an owner what is affected, why it matters and what to change. Record it consistently so teams can compare risk across repositories and release paths without pretending that a single score or tool ranking settles the question.
- Identify affected repositories, shared components and release paths.
- Describe the risk and include the evidence that supports the finding.
- Name an accountable owner, a specific remediation action and a due date.
- Record exceptions and track remediation status across the portfolio.
Prioritize first by potential risk reduction: unauthorized workflow execution, excessive access and artifact tampering are direct threats to the release path. Then consider whether a fix reduces blast radius, improves traceability and can be rolled out safely across repositories. This is a practical way to order work, not a comparative product test or a claim that all controls have equal cost.
When software scanning can help
Manual review establishes the boundary, context and ownership an audit needs. Software may help teams inspect configurations or gain visibility across many repositories, but it does not replace checking whether a finding matters in a particular release path. The OWASP DevSecOps Guideline names OpenSSF Scorecard and zizmor as open-source assessment options, and Cycode and Legit Security as commercial pipeline security posture examples. These are examples, not a comparative ranking, pricing guide or endorsement. See the OWASP guideline for its discussion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
