Patterns That Protect: Securing Workloads in Automated Deployments
summary
Shows concrete, working patterns: uses Terraform to codify GitHub allow lists and GitHub Actions with content-addressed allowlist entries (no human tags), signs artifacts and stores build log checksums, and runs a Nomad/Kubernetes pre-flight revocation check that bails if an image is denied even when cached. Cites tools and costs (GitHub Free / GitHub Actions 3,000 minutes, Kubernetes, Nomad), claims 98% of apps have OSS deps, and publishes runnable code on GitHub so the patterns can be copied and validated immediately.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:05Open source supply chain risks
- 2:54Build process basics
- 7:29Endpoint protection
- 10:22Build server security
- 14:17GitHub org security
- 16:02Trust in build infrastructure
- 17:29Shared responsibility model
- 21:01Layered security with content hashes
- 23:09Security workflows
- 25:15Code signing and logs
- 28:05Verifiable artifacts
- 29:51Hermetic builds
- 32:01Pre-start hooks
- 35:56Shift supply chain security left
- 36:59Collaborative security
- 38:02Closing remarks
related talks
57mGitHub Actions: A Cloudy Day for Security
44mAttacking & Defending Supply Chains. How we got Admin in your Cloud,...
45mA Call to (GitHub) Actions!
43mGitHub Actions Best Practices
42mProtecting CI/CD from malicious deploys
36mTerraform & CI/CD
56mHow to use GitHub Actions with Security in mind
42mProtecting Your GitHub from Supply Chain Attacks