TLDR Tech / DevOps
Securing CI/CD for an open source project: Controlling who runs what
Cilium hardens its software supply chain by restricting who can trigger CI workflows, separating trusted and untrusted code in GitHub Actions, enforcing security reviews for CI changes, pinning dependencies, isolating credentials, and signing releases. The project uses layered controls to reduce supply chain risk while acknowledging remaining gaps such as missing SLSA provenance, limited dependency review, and some workflow components still needing further hardening.
Read the full story