# branch protection rules Published articles for branch protection rules. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## GitHub branch protection bypass can expose protected credentials to workflows DevFeed: [GitHub branch protection bypass can expose protected credentials to workflows]() Original publisher: [Read original article]() Published: 2024-05-31T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub](), [Security](), [Vulnerabilities](), [code productivity]() Tags: [branch-protection-rules](), [github](), [github-branch-protections](), [new-branches](), [protected-branches](), [release-branches](), [release-workflow](), [secret-storage](), [secret-store](), [secrets](), [security](), [security-best-practices](), [use-of-github](), [vulnerability](), [workflows]() ### AI overview The article describes a GitHub branch protection behavior that can allow a newly created branch to become protected and gain access to environment secrets through workflows. The author argues that this behavior can enable credential exfiltration and create risks for projects using wildcard branch protection rules, particularly release workflows. ### Source excerpt Don't let the unexpected derail your projects. Read our guide on embracing uncertainty in software development and unlock new possibilities. ## Blog: How we Sign and Verify Falco Plugins and Rules DevFeed: [Blog: How we Sign and Verify Falco Plugins and Rules]() Original publisher: [Read original article]() Published: 2023-10-18T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [supply-chain-security](), [open-source-security](), [Security](), [Open Source](), [reproducible builds](), [GitHub]() Tags: [best-practices](), [branch-protection-rules](), [code-review](), [falco](), [reproducible-builds](), [rules](), [security](), [software-supply-chain]() ### AI overview This article explains how Falco v0.36.0, falcoctl 0.6.1, and the 0.7.0 Helm chart improve the security of Falco plugins and rule sets. It describes their OCI-based distribution and discusses safeguards against software supply chain attacks, including signing, verification, branch protection, code review, reproducible builds, dependency pinning, build isolation, and MFA. ### Source excerpt Falco v0.36.0 and the Software Supply Chain (SSC) security The latest stable Falco release, v0.36.0, alongside falcoctl 0.6.1 and the 0.7.0 Helm chart introduced new features and improvements to the security of Falco's software supply chain artifacts. Falco's two main downloadable artifacts are plugins and rule sets. They're shipped in the OCI specification format and distributed through the official Falcosecurity OCI repositories. Software supply chain attacks aim at injecting malicious code into software components, to compromise downstream users. These types of attacks are among the primary threats in today's threat landscape. In particular, attackers abuse trust relationships existing between the different open-source stakeholders. The increase in attacks on open-source software throughout the last few years demonstrates that attackers consider them a viable means for spreading malware. SSC safeguards Securing the software supply chain may seem daunting at first glance, but there are a lot of safeguards that can be put in action. And there are ways to categorize them, and ways to prioritize them. Safeguards against supply chain attacks can be classified by control type: directive, preventive, detective, corrective, and recovery. But there ain't no such thing as a free lunch. Besides safeguard classifications, the utility-to-cost ratio can also be an important factor in deciding where to start in improving the supply chain security of software, and can be pretty easy to measure it. There are cheap preventive safeguards that can be implemented in open source projects especially, where stakeholders platea can be pretty wide considering the contributions. For example, branch protection rules are usually simple per-code repository configurations in providers (e.g. GitHub) and alongside pull request-based flows enforcing code review quorum, are also standard best practices nowadays. The same applies to reproducible builds, dependency pinning, build steps isolation, MF ## Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program DevFeed: [Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Scott Johnson]() Topics: [CI/CD](), [Jenkins](), [Rust](), [Git](), [GitHub](), [pull-requests](), [branch protection rules](), [Deployment](), [Ansible]() Tags: [ansible](), [blue-ocean](), [branch-protection-rules](), [cd](), [ci](), [ci-cd](), [cicd](), [deployment](), [git](), [github](), [jenkins](), [pull-requests](), [rust]() ### AI overview A tutorial for setting up CI/CD for a Rust codebase with Jenkins and the Blue Ocean plugin. It covers a Git workflow using feature, develop, and master branches, GitHub branch protection and pull requests, Jenkins deployment behind Nginx, and adding a Jenkinsfile. ### Source excerpt CI / CD or "Continuous Integration / Continuous Deployment" is the process of: taking a source code base running tests against it compiling it (if applicable) deploying it CI / CD is an ongoing process that runs continuously and responds to pull requests on your source code repo. In this blog post we are going to: Take a git repo with a Rust code base Run it thru CI / CD using Jenkins with the Blue Ocean plugin Compile it Deploy it I'm not using Circle CI or another hosted CI / CD system as our overall deploy strategy is complex and Ansible based. Step 1: Correct Git Work Flow The git workflow we are using is: master branch develop branch feature branch All work happens in feature branches. Feature branches are then merged into develop and develop is merged into master. The goal here is that the master branch is always kept pristine. This means that you need to make some change to your github settings: Github Settings / Branches / Default branch - needs to be set to develop Github Settings / Branches / Branch protection rules - develop needs to be protected Here's what you need to do: Create a git repo. Push the code base to it. Create a develop branch in the code base. Change into that branch. Push that branch also. Go to settings for the repo. Click on branches. Set develop as the default branch. Click on branch protection rules. Add develop as a protected branch. This will turn on require pull requests before merging and you can set the number of people who have to approve pull requests before the merge. Add master as a protected branch. For this one you don't want pull requests on; you just want master protected. Step 2: Test the Git Work Flow Now you want to go into your repo and: Create a feature branch, call it "readme", and create / update the readme for the repo. Then you want to push the branch Then you want to follow the pull request url on the branch and submit it by clicking Create Pull Request Step 3: Get Jenkins Setup Traditionally with Blue Ocean Set