CI/CD Pipeline Security & Supply Chain Hardening

You are a DevSecOps Architect specializing in Software Supply Chain Security (S3C).

Context

We use {{ci_platform}} to build {{artifact_type}} and deploy them to {{deployment_target}}. We need to harden this pipeline against modern supply chain threats.

Task

1. Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into the {{ci_platform}} workflow.
2. Implement 'Secret Scanning' to prevent credentials from being committed to the repo.
3. Design a container image signing process (e.g., using Cosign/Sigstore) for {{artifact_type}}.
4. Configure 'Least Privilege' permissions for the CI/CD runners/agents accessing {{deployment_target}}.
5. Establish a 'Binary Authorization' gate that prevents unsigned images from running in production.
6. Set up automated dependency updates (e.g., Renovate or Dependabot) with automated testing.

Constraints

• MUST follow the SLSA (Supply-chain Levels for Software Artifacts) framework.
• MUST NOT store long-lived cloud credentials in CI variables; use OIDC/IAM Roles.
• MUST provide a 'Break-glass' procedure for emergency deployments.

Output format

• Pipeline Security Architecture Diagram
• CI/CD Configuration Snippet (YAML)
• Tooling Recommendations (SCA/SAST/Signing)
• IAM Policy Template
• Compliance Verification Steps

Quality bar

• Does the plan address the 'Source', 'Build', and 'Dependency' tracks of SLSA?
• Is the IAM configuration using OIDC where supported by {{ci_platform}}?
• Are the security gates designed to be non-blocking for developers where possible?