Secure CI/CD with GitLab

Correct — the pipeline is code, reviewed like code.

Correct — lint, unit, and scan in one stage execute together.

Correct — build completes before any test job begins.

Correct — maps to container in Actions, agent{docker} in Jenkins.

Correct — exit 0 = pass, anything else = fail; a failed job fails its stage.

Correct — artifacts are uploaded and made available to later stages.

Correct — a job must still work with an empty cache.

Correct — it replaces only/except and handles conditional jobs.

Correct — reviewed code, deliberate trigger.

Correct — a bad edit can exfiltrate secrets or ship a bad artifact.

Correct — as valuable a target as the servers it deploys to.

Correct — a poisoned build is thrown away with its environment.

Correct — the exact escape path to avoid, especially on shared/fork runners.

Correct — so forks/feature branches cannot read production secrets.

Correct — the MR reads the secrets or roots the host.

Correct — a feature-branch job cannot land on the production runner.

Correct — masking stops log leaks; protected stops untrusted pipelines reading it.

Correct — never echo, base64, or write a secret to a file.

Correct — little to leak; centrally rotated and audited.

Correct — mark sensitive variables protected + masked.

Correct — SQL injection, unsafe deserialization, hardcoded creds.

Correct — a scanner developers trust stays enabled.

Correct — catch the key before it reaches the default branch.

Correct — deleting it in a later commit does not un-leak it.

Correct — you own the vulnerabilities you imported.

Correct — blocking on unfixable CVEs just gets the scanner disabled.

Correct — report everything; gate on what you would page for.

Correct — a sub-30s scan is one nobody routes around.

Correct — scan-then-push keeps bad images out of the registry.

Correct — auth flaws, headers, exposed paths; runs late, often not per-MR.

Correct — verified downstream, it detects tampering/unauthorized images.

Correct — no long-lived key to steal.

Correct — the immutable digest is the bytes; a tag can be repointed.

Correct — an attacker can sign their own image with their own identity.

Correct — signing is half; verification is the control.

Correct — query it when the next CVE drops.

Correct — the Log4Shell fire-drill becomes a query.

Correct — the artifact’s machine-verifiable birth certificate.

Correct — sign + verify, or it adds process without protection.

Correct — belt and braces: judgment plus objective, unskippable checks.

Correct — Argo CD/Flux pull the desired state and apply it.

Correct — a compromised pipeline cannot directly touch the cluster.

Correct — selfHeal reconciles the cluster back to the repo.

Correct — the attack surface moved to "who can merge here".

Correct — reviewed and merged, the agent rolls it out.

Correct — change control without a separate ticket system.

Correct — human judgment plus unskippable checks.

Correct — few users affected if it is bad.

Correct — self-driving: advances on good data, reverts on bad.

Correct — exact and fast, because the good state is in Git.