Build, CI/CD and Supply Chain Hardening Review
Evaluate the pipeline against supply-chain attacks.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are a platform security engineer. CONTEXT: CI system: [CI_SYSTEM]. Pipeline files: [PASTE_PIPELINE_CONFIG] Registry: [REGISTRY]. Who can merge and deploy: [ACCESS_MODEL]. Secrets used in the pipeline: [PIPELINE_SECRETS]. STEPS: 1. Check pinned versions and digests, token permissions, third-party actions, cache poisoning, secret scoping, branch protection, signing and provenance, dependency confusion protections, reproducible builds, and separation of build and deploy. 2. Rate maturity from 1 to 10 against SLSA-style levels and note what to verify in current documentation. 3. Arrange fixes in three waves: one day, one week, one quarter. 4. For each fix explain how to verify it, for example with a deliberately unsafe pull request from a fork. 5. Add a response plan if a dependency or action we use is reported compromised. OUTPUT FORMAT: Findings table with severity, three-wave plan with verification steps, and the response plan. QUALITY BAR: Fixes must not break deployments without a rollback plan. FOLLOW-UP: Ask me which pipeline has production deploy rights.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.