ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
205 articles
The DevSecOps Process, Explained Stage by Stage
A DevSecOps process bakes security into every step of the software delivery lifecycle instead of bolting it on at the end. Here is what each stage actually looks like.
What Does the DevSecOps Acronym Actually Mean?
The DevSecOps acronym stands for Development, Security, and Operations, describing a practice that folds security into the software delivery pipeline rather than bolting it on at the end.
start-server-and-test: Reliable E2E Test Startup in CI
start-server-and-test starts your app, waits until a URL responds, runs your tests, then tears the server down. Getting its wait semantics right is the difference between stable and flaky CI.
tj-actions Supply Chain Attack March 2025: A Postmortem
The tj-actions/changed-files compromise exposed CI secrets across thousands of public repositories. A postmortem on the attack chain and the GitHub Actions trust model.
CVE-2025-47884 in Jenkins OpenID Connect Provider: Patch Posture & SBOM Response
Jenkins OIDC Provider plugin token impersonation scored CVSS 9.1. Defender playbook for CI/CD identity infrastructure.
Trivy Action: How to Use It in CI Without Getting Burned
The Trivy Action runs Aqua Security's scanner inside GitHub Actions. Here is how to wire it up, and why aquasecurity/trivy-action@master is the wrong way to pin it.
Building an Eval Suite for Your Security LLM Workflows
If you use an LLM anywhere in your security program — triage, remediation, detection — you need an eval suite with the same rigor as your test suite. Here is a concrete harness: datasets, thresholds, CI gates, and drift detection.
How to Harden a Dockerfile in 10 Practical Steps
Ten concrete Dockerfile changes — digest pinning, multi-stage builds, non-root users, BuildKit secrets, SBOM attestations — that remove whole classes of container risk.
Drone CI Supply Chain Hardening 2026
A 2026 hardening guide for Drone CI: plugin trust, runner isolation, signed pipelines, secret scoping, and integrating Drone with SLSA and sigstore.
DevOps Success Metrics That Actually Predict Delivery Health
The DevOps success metrics worth tracking are the four DORA measures plus a few reliability and security signals. Vanity dashboards measure activity; these measure outcomes.
How to Implement Shift Left Testing Without Slowing Delivery
Shift left testing means moving quality and security checks earlier, into design and coding, instead of leaving them until the end. Here is a practical way to implement it.
Testing and Debugging for Security: A Practical Guide
Testing and debugging are where most security bugs are actually caught or missed. Here is how to fold security into both without slowing your team down.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.