Skip to content
RockPointCyber
← All pipelines

Sovereign supply chain (both choke points, fully enforced)

GitHub Actions8 stages · 57 controls

What this design covers, and what it leaves

The same field every pipeline is drawn on. A reference design is a position taken on it, so the cells it does not fill are as much a part of the position as the ones it does — this one is deliberately deep in some streams and silent in others.

01Plan
02Code
03Build
04Test
05Release
06Deploy
07Operate
08Monitor
GOVDecide
11Governance and assurance at Plan: 0 targeted, 0 ignored, 11 still open of 11
Governance and assurance at Code: nothing, by the nature of the work
2Governance and assurance at Build: 0 targeted, 0 ignored, 2 still open of 2
Governance and assurance at Test: nothing, by the nature of the work
2Governance and assurance at Release: 0 targeted, 0 ignored, 2 still open of 2
1Governance and assurance at Deploy: 0 targeted, 0 ignored, 1 still open of 1
5Governance and assurance at Operate: 0 targeted, 0 ignored, 5 still open of 5
4Governance and assurance at Monitor: 1 targeted, 0 ignored, 3 still open of 4
SUPAdmit
4Open source and third-party supply at Plan: 0 targeted, 0 ignored, 4 still open of 4
11Open source and third-party supply at Code: 5 targeted, 0 ignored, 6 still open of 11
20Open source and third-party supply at Build: 9 targeted, 0 ignored, 11 still open of 20
2Open source and third-party supply at Test: 0 targeted, 0 ignored, 2 still open of 2
6Open source and third-party supply at Release: 1 targeted, 0 ignored, 5 still open of 6
1Open source and third-party supply at Deploy: 0 targeted, 0 ignored, 1 still open of 1
10Open source and third-party supply at Operate: 1 targeted, 0 ignored, 9 still open of 10
8Open source and third-party supply at Monitor: 2 targeted, 0 ignored, 6 still open of 8
DEVAuthor
8Design and development at Plan: 2 targeted, 0 ignored, 6 still open of 8
22Design and development at Code: 7 targeted, 0 ignored, 15 still open of 22
5Design and development at Build: 1 targeted, 0 ignored, 4 still open of 5
3Design and development at Test: 0 targeted, 0 ignored, 3 still open of 3
2Design and development at Release: 0 targeted, 0 ignored, 2 still open of 2
Design and development at Deploy: nothing, by the nature of the work
4Design and development at Operate: 1 targeted, 0 ignored, 3 still open of 4
3Design and development at Monitor: 0 targeted, 0 ignored, 3 still open of 3
DELProduce
2Build and delivery at Plan: 0 targeted, 0 ignored, 2 still open of 2
10Build and delivery at Code: 3 targeted, 0 ignored, 7 still open of 10
39Build and delivery at Build: 18 targeted, 0 ignored, 21 still open of 39
1Build and delivery at Test: 0 targeted, 0 ignored, 1 still open of 1
18Build and delivery at Release: 7 targeted, 0 ignored, 11 still open of 18
13Build and delivery at Deploy: 8 targeted, 0 ignored, 5 still open of 13
13Build and delivery at Operate: 2 targeted, 0 ignored, 11 still open of 13
4Build and delivery at Monitor: 0 targeted, 0 ignored, 4 still open of 4
VERProve
1Testing and validation at Plan: 0 targeted, 0 ignored, 1 still open of 1
2Testing and validation at Code: 0 targeted, 0 ignored, 2 still open of 2
Testing and validation at Build: nothing, by the nature of the work
10Testing and validation at Test: 0 targeted, 0 ignored, 10 still open of 10
Testing and validation at Release: nothing, by the nature of the work
1Testing and validation at Deploy: 0 targeted, 0 ignored, 1 still open of 1
9Testing and validation at Operate: 0 targeted, 0 ignored, 9 still open of 9
Testing and validation at Monitor: nothing, by the nature of the work
OPSRun
Runtime and platform at Plan: nothing, by the nature of the work
Runtime and platform at Code: nothing, by the nature of the work
1Runtime and platform at Build: 0 targeted, 0 ignored, 1 still open of 1
Runtime and platform at Test: nothing, by the nature of the work
Runtime and platform at Release: nothing, by the nature of the work
5Runtime and platform at Deploy: 4 targeted, 0 ignored, 1 still open of 5
35Runtime and platform at Operate: 4 targeted, 0 ignored, 31 still open of 35
2Runtime and platform at Monitor: 0 targeted, 0 ignored, 2 still open of 2
OBSWatch
3Detection and continuous observation at Plan: 0 targeted, 0 ignored, 3 still open of 3
1Detection and continuous observation at Code: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Build: nothing, by the nature of the work
1Detection and continuous observation at Test: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Release: nothing, by the nature of the work
Detection and continuous observation at Deploy: nothing, by the nature of the work
7Detection and continuous observation at Operate: 1 targeted, 0 ignored, 6 still open of 7
21Detection and continuous observation at Monitor: 1 targeted, 0 ignored, 20 still open of 21
Attacks
none modeled
2 open
2 open
none modeled
1 open
1 held
none modeled
none modeled
GOV Governance and assurance
The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply
Everything you did not write, arriving faster than you can review it.
DEV Design and development
Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery
The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation
The stream that finds out whether any of the others worked.
OPS Runtime and platform
The last place to stop something, and the most expensive.
OBS Detection and continuous observation
The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 78 targeted, 0 ignored, 255 still open, of 333. A ring means the cell is closed. Your 57 controls account for 78 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

Stages and gates

Each control is a link to the products that provide it, and each of those opens its full profile. Blocking gates fail the build; advisory, monitor and manual ones do not.

This is a reference design, so no products are assigned to its stages. Each control links to the products that provide it, and where two or more of those carry evaluation scores you can compare them head to head.

  1. 01

    Plan and design

    01Plan

    4 controls · 1 blocking

  2. 02

    Source control

    02Code

    7 controls · 6 blocking

  3. 03

    Trusted dependency intake

    02Code

    8 controls · 7 blocking

  4. 04

    Workflow, runner and identity hardening

    03Build

    9 controls · 8 blocking

  5. 05

    Build, test and verify

    03Build

    8 controls · 6 blocking

  6. 06

    Release with evidence bound to the digest

    05Release

    6 controls · 5 blocking

  7. 07

    Admission and deployment

    06Deploy

    7 controls · 7 blocking

  8. 08

    Operate, detect and learn

    08Monitor

    8 controls · 2 blocking

Framework coverage

Controls these capabilities let you evidence. Partial is the normal case; the remainder is the work.

  • ASVS 5.0

    7 of 17

    OWASP Application Security Verification Standard (ASVS) 5.0.0

    V1 · V5 · V9 · V10 · V12 · V13 · V16

  • CI/CD Top 10

    10 of 10

    OWASP Top 10 CI/CD Security Risks

    CICD-SEC-1 · CICD-SEC-10 · CICD-SEC-2 · CICD-SEC-3 · CICD-SEC-4 · CICD-SEC-5 · CICD-SEC-6 · CICD-SEC-7 · CICD-SEC-8 · CICD-SEC-9

  • S2C2F

    18 of 25

    OpenSSF Secure Supply Chain Consumption Framework (S2C2F)

    AUD-2 · AUD-3 · AUD-4 · ENF-1 · ENF-2 · ING-2 · ING-3 · ING-4 · INV-1 · INV-2 · REB-1 · REB-2 · +6 more

  • SLSA 1.2

    11 of 16

    Supply-chain Levels for Software Artifacts (SLSA) 1.2

    Build L1 — Provenance generated and distributed · Build L2 — Consumer validates provenance · Build L2 — Hosted build platform · Build L2 — Signed provenance · Build L3 — Run isolation · Build L3 — Signing secrets isolated · Source L2 — Continuous immutable history · Source L2 — Source provenance attestations · Source L3 — Enforced technical controls · Source L4 — Two-party review · Verification — Verification Summary Attestation

  • SSDF 1.1

    16 of 42

    NIST Secure Software Development Framework 1.1 (SP 800-218)

    PO.5.1 · PS.1.1 · PS.2.1 · PW.1.1 · PW.4.1 · PW.6.1 · PW.7.1 · PW.9.1 · RV.1.1 · RV.2.1 · PO.1.2 · PO.3.2 · +4 more

  • Scorecard

    8 of 20

    OpenSSF Scorecard Checks

    Branch-Protection · Code-Review · Dangerous-Workflow · Pinned-Dependencies · SAST · SBOM · Security-Policy · Token-Permissions

Coverage by phase

  • Plan

    Not modeled

    No attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.

  • Code

    2 countered · 2 open of 4

  • Build

    9 countered · 2 open of 11

  • Release

    3 countered · 1 open of 4

  • Deploy

    1 countered · 0 open of 1

  • Monitor

    Not modeled

    No attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.

Attacks this pipeline faces

Techniques modeled against the phases this pipeline covers, ordered by how many documented real-world incidents used them.

  • Maintainer Account Takeover

    Countered10 real incidents

    Common · Release

    Countered by Developer & Maintainer MFA Enforcement, Malicious Package Detection, Minimum Release Age Enforcement, Trusted Publishing.

  • Stolen Publishing Token

    Countered9 real incidents

    Common · Release

    Countered by Access Token Scoping & Least Privilege, Deployment Environment Protection, Engineering Platform Audit Log Monitoring, Rebuilt-from-Source Dependency Provisioning, Trusted Publishing.

  • Artifact Tampering After Build

    Countered7 real incidents

    Common · Release

    Countered by Artifact Digest Integrity Verification, Build Provenance Attestation, Dependency Pinning & Lockfile Integrity Verification, Immutable Artifact Versioning, Keyless Signing with Transparency Log.

  • CI Runner Secret Exfiltration

    Countered5 real incidents

    Common · Build

    Countered by Build Egress Control & Network Monitoring, Pipeline Permission Minimization.

  • Malicious Install-Time Script

    Countered5 real incidents

    Very Common · Build

    Countered by Install Script Execution Restriction, Malicious Package Detection.

  • Abandoned Package or Domain Takeover

    Open2 real incidents

    Common · Release

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Maintainer & Publisher Risk Analysis, Open Source Project Health Scoring.

  • Build Cache Poisoning

    Countered2 real incidents

    Emerging · Build

    Countered by Untrusted Workflow Trigger Isolation.

  • Dependency Confusion

    Countered2 real incidents

    Common · Build

    Countered by Dependency Confusion Prevention, Private Registry Proxy & Curation.

  • Mutable Tag Hijack of CI Actions and Images

    Countered2 real incidents

    Common · Build

    Countered by Curated Hardened Action Catalog, Image Digest Pinning Enforcement, Immutable Artifact Versioning, Supply Chain Incident Response, Third-Party Action & Plugin Pinning Enforcement.

  • Pwn Request (Privileged Trigger Abuse)

    Countered2 real incidents

    Common · Build

    Countered by Untrusted Workflow Trigger Isolation.

  • Self-Propagating Package Worm

    Countered2 real incidents

    Emerging · Build

    Countered by Compromised Component Blast-Radius Analysis, Install Script Execution Restriction, Malicious Package Detection, Minimum Release Age Enforcement, Supply Chain Incident Response.

  • Unauthorized Commit Injection

    Countered2 real incidents

    Common · Code

    Countered by Branch Protection & Ruleset Enforcement, Code Review Enforcement, Commit Signing & Verification, Workflow Change Review Enforcement.

8 further techniques with no documented incidents

Not in this comparison

Does not apply to this kind of pipeline
phases A reference pipeline has authored stages rather than a phase grouping.
gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A reference pipeline models the design, not an estate.

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 209 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.