Skip to main content

Technical Annex - Applying SbD-ToE to the CI/CD Pipeline

This annex complements the case study on applying the SbD-ToE manual to the CI/CD pipeline as an L3 project, providing reusable technical and operational artefacts for engineering, security and governance teams.

✅ Validation Checkpoints by Phase​

PhaseValidationSuggested toolSbD-ToE chapter
PlanningDocumented threat modellingIriusRisk, ExcelCh. 03 - Threat Model
DesignL3 requirements assigned to the projectCatalogue of Ch. 02, 07Ch. 02, 07 - Requirements
ImplementationLinters, mandatory reviewSemgrep, ESLint, PRsCh. 06 - Secure Dev
BuildSBOM generated for the pipelinesyft, cyclonedxCh. 05, 07
TestsSecurity validations of the pipelinetrivy, semgrep, CICh. 07, Ch. 10
DeployProvenance and signingcosign, slsa-provenanceCh. 07, 09
OperationsLogging, traceability, alertsAuditLogs, KibanaCh. 12 - Monitoring and Operations

🧩 Relevant User Stories​

**Como engenheiro de DevOps**,  

Quero que o pipeline da plataforma gere um SBOM próprio,  
Para garantir que todas as tasks, containers e SDKs usados estão inventariados e rastreados.

**Como responsável de segurança**,  

Quero aplicar threat modeling formal ao pipeline CI/CD,  
Para identificar vetores de ataque e definir controlos preventivos.

**Como gestor de conhecimento**,  

Quero que o processo de onboarding inclua formação sobre segurança do pipeline,  
Para garantir que todos os contribuidores compreendem o impacto da infraestrutura de entrega.

**Como auditor de segurança**,  

Quero validar se os runners utilizados estão isolados e corretamente configurados,  
Para mitigar riscos de execução maliciosa ou persistência de agentes externos.

📜 Applicable Requirements​

IDDescriptionApplicableSource
REQ-L3-001The pipeline must have a versioned SBOM per build✔Ch. 05, 07
REQ-L3-014The runner used must be segregated by function✔Ch. 09
REQ-L3-019The pipeline tasks must be analysed for vulnerabilities✔Ch. 05, 07
REQ-L3-027Every change to the pipeline must go through review✔Ch. 06
REQ-L3-038The pipeline must be subject to explicit threat modelling✔Ch. 03, 07
REQ-L3-045The pipeline must undergo automated security testing✔Ch. 07, 10
REQ-L3-048There must be logging and traceability of runs✔Ch. 12
REQ-L3-052Training of teams on CI/CD security✔Ch. 13

📋 Operational Checklist​

ItemYes/No
Has the pipeline been formally classified as an L3 asset?
Is there a documented threat model, reviewed periodically?
Are the runners used segregated and controlled?
Does the pipeline itself have a generated and signed SBOM?
Are the tasks used (e.g. GitHub Actions, SDKs) inventoried?
Are the pipeline dependencies subject to SCA analysis?
Is the ci-pipeline.yml versioned and subject to mandatory review?
Have secure development practices been applied to the pipeline?
Is there a formal exception and review process for bypasses?
Has training on secure CI/CD been delivered to the relevant teams?
Have security tests been applied to the pipeline?
Is end-to-end traceability ensured (build → deploy)?

✅ Final Considerations​

This annex translates the narrative prescription of the case study into concrete and auditable technical elements, promoting the effective and traceable adoption of SbD-ToE in the lifecycle of the pipelines themselves.

📌 The pipeline is a critical asset. Treating its lifecycle like that of any other L3 product is a fundamental step towards maturity in supply chain security.