Skip to content
RockPointCyber
← All pipelines

Hardened container delivery (Chainguard from base image to admission)

GitHub Actions6 stages · 24 controls · 25 placements

What this design covers, and what it leaves

The same field every pipeline is drawn on. A reference design is a position taken on it, so the cells it does not fill are as much a part of the position as the ones it does — this one is deliberately deep in some streams and silent in others.

01Plan
02Code
03Build
04Test
05Release
06Deploy
07Operate
08Monitor
GOVDecide
11Governance and assurance at Plan: 0 targeted, 0 ignored, 11 still open of 11
Governance and assurance at Code: nothing, by the nature of the work
2Governance and assurance at Build: 0 targeted, 0 ignored, 2 still open of 2
Governance and assurance at Test: nothing, by the nature of the work
2Governance and assurance at Release: 0 targeted, 0 ignored, 2 still open of 2
1Governance and assurance at Deploy: 0 targeted, 0 ignored, 1 still open of 1
5Governance and assurance at Operate: 0 targeted, 0 ignored, 5 still open of 5
4Governance and assurance at Monitor: 0 targeted, 0 ignored, 4 still open of 4
SUPAdmit
4Open source and third-party supply at Plan: 0 targeted, 0 ignored, 4 still open of 4
11Open source and third-party supply at Code: 0 targeted, 0 ignored, 11 still open of 11
20Open source and third-party supply at Build: 2 targeted, 0 ignored, 18 still open of 20
2Open source and third-party supply at Test: 0 targeted, 0 ignored, 2 still open of 2
6Open source and third-party supply at Release: 1 targeted, 0 ignored, 5 still open of 6
1Open source and third-party supply at Deploy: 0 targeted, 0 ignored, 1 still open of 1
10Open source and third-party supply at Operate: 1 targeted, 0 ignored, 9 still open of 10
8Open source and third-party supply at Monitor: 0 targeted, 0 ignored, 8 still open of 8
DEVAuthor
8Design and development at Plan: 0 targeted, 0 ignored, 8 still open of 8
22Design and development at Code: 2 targeted, 0 ignored, 20 still open of 22
5Design and development at Build: 0 targeted, 0 ignored, 5 still open of 5
3Design and development at Test: 1 targeted, 0 ignored, 2 still open of 3
2Design and development at Release: 0 targeted, 0 ignored, 2 still open of 2
Design and development at Deploy: nothing, by the nature of the work
4Design and development at Operate: 0 targeted, 0 ignored, 4 still open of 4
3Design and development at Monitor: 0 targeted, 0 ignored, 3 still open of 3
DELProduce
2Build and delivery at Plan: 0 targeted, 0 ignored, 2 still open of 2
10Build and delivery at Code: 1 targeted, 0 ignored, 9 still open of 10
39Build and delivery at Build: 12 targeted, 0 ignored, 27 still open of 39
1Build and delivery at Test: 0 targeted, 0 ignored, 1 still open of 1
18Build and delivery at Release: 8 targeted, 0 ignored, 10 still open of 18
13Build and delivery at Deploy: 5 targeted, 0 ignored, 8 still open of 13
13Build and delivery at Operate: 2 targeted, 0 ignored, 11 still open of 13
4Build and delivery at Monitor: 0 targeted, 0 ignored, 4 still open of 4
VERProve
1Testing and validation at Plan: 0 targeted, 0 ignored, 1 still open of 1
2Testing and validation at Code: 0 targeted, 0 ignored, 2 still open of 2
Testing and validation at Build: nothing, by the nature of the work
10Testing and validation at Test: 0 targeted, 0 ignored, 10 still open of 10
Testing and validation at Release: nothing, by the nature of the work
1Testing and validation at Deploy: 0 targeted, 0 ignored, 1 still open of 1
9Testing and validation at Operate: 0 targeted, 0 ignored, 9 still open of 9
Testing and validation at Monitor: nothing, by the nature of the work
OPSRun
Runtime and platform at Plan: nothing, by the nature of the work
Runtime and platform at Code: nothing, by the nature of the work
1Runtime and platform at Build: 0 targeted, 0 ignored, 1 still open of 1
Runtime and platform at Test: nothing, by the nature of the work
Runtime and platform at Release: nothing, by the nature of the work
5Runtime and platform at Deploy: 2 targeted, 0 ignored, 3 still open of 5
35Runtime and platform at Operate: 1 targeted, 0 ignored, 34 still open of 35
2Runtime and platform at Monitor: 0 targeted, 0 ignored, 2 still open of 2
OBSWatch
3Detection and continuous observation at Plan: 0 targeted, 0 ignored, 3 still open of 3
1Detection and continuous observation at Code: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Build: nothing, by the nature of the work
1Detection and continuous observation at Test: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Release: nothing, by the nature of the work
Detection and continuous observation at Deploy: nothing, by the nature of the work
7Detection and continuous observation at Operate: 0 targeted, 0 ignored, 7 still open of 7
21Detection and continuous observation at Monitor: 0 targeted, 0 ignored, 21 still open of 21
Attacks
none modeled
4 open
10 open
none modeled
3 open
1 held
12 open
none modeled
GOV Governance and assurance
The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply
Everything you did not write, arriving faster than you can review it.
DEV Design and development
Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery
The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation
The stream that finds out whether any of the others worked.
OPS Runtime and platform
The last place to stop something, and the most expensive.
OBS Detection and continuous observation
The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 38 targeted, 0 ignored, 295 still open, of 333. A ring means the cell is closed. Your 24 controls account for 38 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

Stages and gates

Each control is a link to the products that provide it, and each of those opens its full profile. Blocking gates fail the build; advisory, monitor and manual ones do not.

This is a reference design, so no products are assigned to its stages. Each control links to the products that provide it, and where two or more of those carry evaluation scores you can compare them head to head.

  1. 01

    Base image selection

    02Code

    3 controls · 3 blocking

  2. 02

    Automated migration and equivalence testing

    03Build

    3 controls · 1 blocking

  3. 03

    Build, scan and attest

    03Build

    5 controls · 3 blocking

  4. 04

    Sign and publish by digest

    05Release

    5 controls · 5 blocking

  5. 05

    Admission verification

    06Deploy

    5 controls · 5 blocking

  6. 06

    Freshness and drift management

    07Operate

    4 controls · 1 blocking

Framework coverage

Controls these capabilities let you evidence. Partial is the normal case; the remainder is the work.

  • ASVS 5.0

    1 of 17

    OWASP Application Security Verification Standard (ASVS) 5.0.0

    V13

  • CI/CD Top 10

    3 of 10

    OWASP Top 10 CI/CD Security Risks

    CICD-SEC-1 · CICD-SEC-3 · CICD-SEC-9

  • S2C2F

    7 of 25

    OpenSSF Secure Supply Chain Consumption Framework (S2C2F)

    AUD-3 · AUD-4 · INV-1 · REB-2 · REB-3 · REB-4 · UPD-2

  • SLSA 1.2

    6 of 16

    Supply-chain Levels for Software Artifacts (SLSA) 1.2

    Build L1 — Provenance generated and distributed · Build L2 — Consumer validates provenance · Build L2 — Signed provenance · Build L3 — Signing secrets isolated · Source L2 — Continuous immutable history · Verification — Verification Summary Attestation

  • SSDF 1.1

    8 of 42

    NIST Secure Software Development Framework 1.1 (SP 800-218)

    PS.2.1 · PW.4.1 · PW.9.1 · RV.1.1 · PS.3.2 · PW.8.2 · RV.2.2 · RV.3.3

  • Scorecard

    3 of 20

    OpenSSF Scorecard Checks

    Pinned-Dependencies · SBOM · Signed-Releases

Coverage by phase

  • Code

    0 countered · 4 open of 4

  • Build

    1 countered · 10 open of 11

  • Release

    1 countered · 3 open of 4

  • Deploy

    1 countered · 0 open of 1

  • Operate

    1 countered · 12 open of 13

Attacks this pipeline faces

Techniques modeled against the phases this pipeline covers, ordered by how many documented real-world incidents used them.

  • Trusted Supplier Compromise

    Open12 real incidents

    Common · Operate

    Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.

  • Maintainer Account Takeover

    Open10 real incidents

    Common · Release

    Nothing in this pipeline counters it. The graph knows 6 capabilities that would: Developer & Maintainer MFA Enforcement, Maintainer & Publisher Risk Analysis, Malicious Package Detection, Minimum Release Age Enforcement, and others.

  • Stolen Publishing Token

    Open9 real incidents

    Common · Release

    Nothing in this pipeline counters it. The graph knows 7 capabilities that would: Access Token Scoping & Least Privilege, Deployment Environment Protection, Engineering Platform Audit Log Monitoring, Leaked Credential Validation & Revocation, and others.

  • Artifact Tampering After Build

    Countered7 real incidents

    Common · Release

    Countered by Artifact Digest Integrity Verification, Artifact Signing, Build Provenance Attestation, Immutable Artifact Versioning, Keyless Signing with Transparency Log.

  • CI Runner Secret Exfiltration

    Open5 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Build Egress Control & Network Monitoring, Pipeline Permission Minimization, Pipeline Runtime Anomaly Detection, Secrets Detection in CI Logs & Artifacts.

  • Exploitation of Known Vulnerable Component

    Countered5 real incidents

    Very Common · Operate

    Countered by Container Image Vulnerability Scanning, Minimal Hardened Base Images.

  • Leaked Secret Abuse

    Open5 real incidents

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Dynamic Short-Lived Credentials, Leaked Credential Validation & Revocation, Secret Push Protection, Secrets Detection in Source Code, and others.

  • Malicious Install-Time Script

    Open5 real incidents

    Very Common · Build

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Install Script & Package Behavior Analysis, Install Script Execution Restriction, Malicious Package Detection.

  • Abandoned Package or Domain Takeover

    Open2 real incidents

    Common · Release

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Maintainer & Publisher Risk Analysis, Open Source Project Health Scoring.

  • Adversary-in-the-Middle MFA Phishing

    Open2 real incidents

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Developer & Maintainer MFA Enforcement, Multi-Factor Authentication, Phishing & Business Email Compromise Protection.

  • Build Cache Poisoning

    Open2 real incidents

    Emerging · Build

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Build Cache Poisoning Prevention, Untrusted Workflow Trigger Isolation.

  • Dependency Confusion

    Open2 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Dependency Confusion Prevention, Dependency Curation & Allowlisting, Namespace & Package Name Reservation, Private Registry Proxy & Curation.

21 further techniques with no documented incidents

Not in this comparison

Does not apply to this kind of pipeline
phases A reference pipeline has authored stages rather than a phase grouping.
gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A reference pipeline models the design, not an estate.

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 700 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.