# CICD Published articles for CICD. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Blog: Detecting Supply Chain Attacks with Falco Actions DevFeed: [Blog: Detecting Supply Chain Attacks with Falco Actions]() Original publisher: [Read original article]() Published: 2025-03-19T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [supply chain attacks](), [GitHub Actions](), [Security](), [GitHub](), [Containers](), [Kubernetes](), [Linux Kernel]() Tags: [cicd](), [falco](), [github-action](), [github-actions](), [kubernetes](), [linux](), [linux-kernel](), [pull-request](), [runtime-security](), [security](), [software-supply-chain](), [supply-chain-attacks](), [supplychain]() ### AI overview This tutorial explains how to use Falco Actions in GitHub Actions workflows to detect suspicious behavior and software supply chain attacks in CI/CD pipelines. It covers runtime monitoring, custom rules, workflow setup, findings, and generated reports. ### Source excerpt The recently discovered CVE for the GitHub action tj-actions/changed-files brought to light a topic that is really critical for companies: supply chain attacks. With that, we want to discuss and show a bit about how Falco can help your organization detect this kind of attack and other suspect behaviors inside your CI/CD pipeline. What is Falco? Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations. What is Falco Actions? Falco Actions enable you to run Falco in GitHub Actions to detect suspicious behavior in your CI/CD workflows. If you run it in a pull request, the action will create a comment with the findings. Thanks to ad-hoc Falco rules specific to this use case, these GitHub actions can monitor your GitHub runner and detect software supply chain attacks. Using Falco Actions To have Falco inside your pipeline, you need to add these two actions: falcosecurity/falco-actions/start falcosecurity/falco-actions/stop Below you can see an example: name: CI on: push: pull_request: jobs: build: runs-on: ubuntu-latest permissions: contents: read actions: read steps: - uses: actions/checkout@v4 - name: Start Falco uses: falcosecurity/falco-actions/start@main with: mode: live falco-version: '0.40.0' verbose: true - name: My Custom Step run: | echo "This is my custom step" - name: Stop Falco uses: falcosecurity/falco-actions/start@main with: mode: live verbose: true OBS: main is being used here only to simplify how it works, you should always pin your dependencies to a specific commit SHA. After the execution, you will be able to see the results at the github action summary. If you want a more detailed report, you can use the action fal ## Unlocking efficiency and security on GitLab: On-demand images with 0-CVE packages powered by Wolfi DevFeed: [Unlocking efficiency and security on GitLab: On-demand images with 0-CVE packages powered by Wolfi]() Original publisher: [Read original article]() Published: 2023-10-30T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [GitLab](), [CI/CD](), [Docker](), [Kubernetes]() Tags: [ci-cd](), [cicd](), [container-images](), [containers](), [dockerfiles](), [efficiency](), [gitlab](), [kubernetes](), [security](), [wolfi]() ### AI overview This tutorial explains how to integrate the wolfi-act project with GitLab CI/CD, focusing on Docker and Kubernetes executors and on-demand images with 0-CVE packages powered by Wolfi. ### Source excerpt Experience secure, efficient GitLab operations with 0-CVE on-demand images, fueled by Wolfi OS. ## Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance DevFeed: [Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance]() Original publisher: [Read original article]() Published: 2023-06-30T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [CI/CD](), [supply-chain-security](), [DevSecOps](), [Cybersecurity](), [cisa]() Tags: [chainguard-images](), [ci-cd](), [cicd](), [cisa](), [continuous-verification](), [cybersecurity](), [devsecops](), [secure-software-development-frameworks](), [security](), [sigstore](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview This commentary explains NSA and DHS CISA guidance for securing CI/CD environments. It highlights risks to downstream environments and software consumers, including compromised developer credentials and application libraries, and recommends established software supply chain security frameworks such as SLSA and CNCF best practices. ### Source excerpt Fortify your CI/CD environments with insights from NSA and DHS CISA guidance, presented by Chainguard. ## Sigstore policy-controller 101 DevFeed: [Sigstore policy-controller 101]() Original publisher: [Read original article]() Published: 2023-03-29T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [sigstore policy controller](), [supply-chain-security](), [Kubernetes admission controller](), [Kubernetes]() Tags: [admission-controller](), [cicd](), [cloud-native](), [cluster-security](), [container-images](), [container-security](), [cosign](), [getting-started](), [how-to](), [kubernetes](), [kubernetes-admission-controller](), [kubernetes-clusters](), [security-policies](), [signing-containers](), [sigstore](), [sigstore-policy-controller](), [software-supply-chain-security]() ### AI overview This tutorial introduces Sigstore policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. It explains how to install the controller in a local kind cluster and configure declarative policies for trusted registries, signed images, and other container conditions. ### Source excerpt Chainguard breaks down the benefits of Sigstore's policy-controller, a Kubernetes admission controller that integrates with Cosign and the Sigstore standard. ## Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO) DevFeed: [Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO)]() Original publisher: [Read original article]() Author: Niko Jernejsek Published: 2022-12-22T10:32:09Z Content type: article Language: en Sources: [Homegate Engineering Blog - Medium]() Topics: [AWS IAM Identity Center](), [AWS Organizations](), [Single sign-on (SSO)](), [Authorization](), [IAM](), [CI/CD]() Tags: [aws](), [aws-eventbridge](), [aws-iam](), [aws-iam-identity-center](), [aws-organizations](), [cicd](), [cloudformation](), [iam-identity-center](), [least-privilege](), [saml](), [security](), [sso]() ### AI overview This article describes Homegate's multi-account AWS strategy and its use of AWS IAM Identity Center, formerly AWS SSO, to centrally manage permissions for engineers across AWS accounts. It explains the use of permission matrices, least-privilege access, AWS Organizations, external identity providers through SAML 2.0, and SCIM. ### Source excerpt Background Homegate was founded in 2001 and is now the leading property marketplace in Switzerland. Few years ago we decided to re-architect our monolithic real estate platform towards micro services on top of AWS cloud. At the moment, Homegate workloads are running almost exclusively on server-less compute model with teams organised around micro services. We are utilising so called multi-account strategy where we structure our AWS accounts around individual micro services further breaking them down into different accounts according to software lifecycle, and organising them into the AWS Organizational Units. We've structured our AWS Organizations Units & AWS accounts according to the recommendations provided by AWS (https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/basic-organization.html#basic-organization-with-cicd-as-a-separate-function). Apart from having product workload accounts we also have accounts which are necessary to operate security, governance and platform related workloads. Access to accounts is governed by a permission matrix which is based on least privilege principles. The permission matrix classifies who (internally defined personas, e.g.: engineers/managers/security officers, etc) has what type of access (e.g. read-only or admin), and to what category of AWS accounts (e.g. production workloads, shared infra accounts, etc). Group of accounts in our Permission Matrix are at the same time AWS Organisational Units that we implement. As we have to manage permissions for hundreds of engineers to about hundred of AWS accounts accordingly, this way of grouping makes it easier for us to manage it at scale. IAM Identity Center PrimerIAM Identity Center Intro Note that I will be using AWS IAM Identity Center and AWS SSO interchangeably as even some services (such as CloudFormation) are still using the previous name AWS SSO. AWS IAM Identity Center is a single sign-on (SSO) service that allows AWS users to centrally manage acces ## DIY Website with HUGO DevFeed: [DIY Website with HUGO]() Original publisher: [Read original article]() Author: dustin@dustn.dev (Dustin Summers) Published: 2020-09-26T10:26:38Z Content type: tutorial Language: en Sources: [Dustin Summers]() Topics: [Hugo](), [Development](), [coding](), [CI/CD](), [hosting](), [Software Engineering]() Tags: [blog](), [cicd](), [development](), [diy](), [go-hugo-firebase-docker-git-github-github-actions](), [hosting](), [hugo](), [portfolio](), [software-development](), [website]() ### AI overview A step-by-step guide for people with little coding experience to build a customized personal portfolio or blog website with Hugo. It covers website creation, repositories, hosting, and CI/CD pipelines, while presenting the process as a multi-weekend learning journey. ### Source excerpt Building a personal portfolio or blog website can be inexpensive and a fun learning experience. Sites like SquareSpace, Wix, WordPress are great if you just want to immediately start writing blogs, but they can either be pricey or lack some customization that you may desire. For instance, sites like Wix/SquareSpace monthly fee's can be from $12.00 - $22.00 a month. Some may think that is worth it and decide to go that route. ## Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program DevFeed: [Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Scott Johnson]() Topics: [CI/CD](), [Jenkins](), [Rust](), [Git](), [GitHub](), [pull-requests](), [branch protection rules](), [Deployment](), [Ansible]() Tags: [ansible](), [blue-ocean](), [branch-protection-rules](), [cd](), [ci](), [ci-cd](), [cicd](), [deployment](), [git](), [github](), [jenkins](), [pull-requests](), [rust]() ### AI overview A tutorial for setting up CI/CD for a Rust codebase with Jenkins and the Blue Ocean plugin. It covers a Git workflow using feature, develop, and master branches, GitHub branch protection and pull requests, Jenkins deployment behind Nginx, and adding a Jenkinsfile. ### Source excerpt CI / CD or "Continuous Integration / Continuous Deployment" is the process of: taking a source code base running tests against it compiling it (if applicable) deploying it CI / CD is an ongoing process that runs continuously and responds to pull requests on your source code repo. In this blog post we are going to: Take a git repo with a Rust code base Run it thru CI / CD using Jenkins with the Blue Ocean plugin Compile it Deploy it I'm not using Circle CI or another hosted CI / CD system as our overall deploy strategy is complex and Ansible based. Step 1: Correct Git Work Flow The git workflow we are using is: master branch develop branch feature branch All work happens in feature branches. Feature branches are then merged into develop and develop is merged into master. The goal here is that the master branch is always kept pristine. This means that you need to make some change to your github settings: Github Settings / Branches / Default branch - needs to be set to develop Github Settings / Branches / Branch protection rules - develop needs to be protected Here's what you need to do: Create a git repo. Push the code base to it. Create a develop branch in the code base. Change into that branch. Push that branch also. Go to settings for the repo. Click on branches. Set develop as the default branch. Click on branch protection rules. Add develop as a protected branch. This will turn on require pull requests before merging and you can set the number of people who have to approve pull requests before the merge. Add master as a protected branch. For this one you don't want pull requests on; you just want master protected. Step 2: Test the Git Work Flow Now you want to go into your repo and: Create a feature branch, call it "readme", and create / update the readme for the repo. Then you want to push the branch Then you want to follow the pull request url on the branch and submit it by clicking Create Pull Request Step 3: Get Jenkins Setup Traditionally with Blue Ocean Set ## CICD for Serverless Part 2 - AWS CodePipeline Integration DevFeed: [CICD for Serverless Part 2 - AWS CodePipeline Integration]() Original publisher: [Read original article]() Author: Pete Johnson Published: 2017-02-22T00:00:00Z Content type: tutorial Language: en Sources: [Serverless Blog]() Topics: [CI/CD](), [Serverless](), [Amazon Web Services]() Tags: [aws](), [aws-lambda](), [cicd](), [cloud-computing](), [engineering](), [faas](), [function-as-a-service](), [how-to](), [implement](), [infrastructure-as-code](), [integration](), [project](), [serverless](), [serverless-architecture](), [serverless-framework](), [workflow]() ### AI overview Part 2 of a tutorial on implementing a CI/CD workflow for a Serverless project, covering AWS CodePipeline integration. ### Source excerpt Part 2 of 2 on how to implement a CICD workflow for a Serverless project ## CICD for Serverless Part 1 - Mocha Endpoint Testing DevFeed: [CICD for Serverless Part 1 - Mocha Endpoint Testing]() Original publisher: [Read original article]() Author: Pete Johnson Published: 2017-02-17T00:00:00Z Content type: tutorial Language: en Sources: [Serverless Blog]() Topics: [Serverless](), [CI/CD](), [Mocha](), [Testing]() Tags: [aws](), [aws-lambda](), [cicd](), [cloud-computing](), [engineering](), [faas](), [function-as-a-service](), [how-to](), [infrastructure-as-code](), [serverless](), [serverless-architecture](), [serverless-framework](), [testing](), [workflow]() ### AI overview Part 1 of a two-part tutorial on implementing a CI/CD workflow for a Serverless project, focusing on Mocha endpoint testing. ### Source excerpt Part 1 of 2 on how to implement a CICD workflow for a Serverless project