[carlospolop]

Blog URL

https://labs.sra.io/posts/cicd_protected_build_jobs

Blog Title

CI/CD Protected Build Jobs: Isolating Build and Publish Phases

Blog high summary

The post explains TeamPCP/Shai-Hulud-style CI/CD supply-chain attacks: a poisoned dependency or pipeline executes during npm ci, steals a workflow-wide NPM token or OIDC capability, and publishes poisoned packages. A publish-capable workflow can enable credential theft, worm-like propagation, and effective production-administrator access.

Mitigate by keeping untrusted builds at contents: read, exposing registry secrets only to publication, and moving id-token: write into a separate publish job that downloads a one-day artifact. Pin dependencies/actions to commit SHAs and add cooldowns; this limits build-stage theft, not deployment-time or local attacks.

PR changes

• src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md: Added the build-to-publish privilege crossing section, including credential scope, publish-hook exposure, the npm ci lockfile constraint, and links to artifact poisoning and AWS federation.
• src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md: Explained role-ARN discovery from checked-out workflows or job environment variables and linked to the npm build/publish boundary.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The retained constraints and failure modes are source-supported and add detail absent from the related base pages. The AWS clarification is accurate, and its citations now support the relevant sentences. The repair report now lists only the AWS page, the sole file changed relative to the original PR head.

Head: 6d066f32aa6558ab1ecb3a928c7c449ad624415e

[carlospolop]

merge