Supply Chain Security - CI/CD Glossary Definition
Supply chain security is the practice of protecting every step that produces and delivers software (source, dependencies, build, and distribution) against tampering. In CI/CD it covers signed commits, pinned and verified dependencies, hardened build runners, and signed, attested artifacts.
Common building blocks
An SBOM lists what is inside an artifact, signing (cosign/sigstore) proves who built it, and provenance attestations record how and where it was built. Frameworks like SLSA describe maturity levels for these controls.
In CI
Pinning actions and dependencies by digest, running builds on ephemeral runners with least-privilege credentials, and generating provenance during the build are concrete supply-chain controls a pipeline can adopt.
Related guides
SBOM - CI/CD Glossary DefinitionAn SBOM (Software Bill of Materials) is a machine-readable inventory of every component and dependency in a b…
Provenance Attestation - CI/CD Glossary DefinitionProvenance Attestation: A provenance attestation is signed metadata that records how an artifact was built: t…
Cosign Signing - CI/CD Glossary DefinitionCosign Signing: Cosign is a tool from the Sigstore project that signs and verifies container images and other…