DevSecOps › Module 3 › Lesson 4
Lab — Pipeline
Pack GitHub Actions hygiene, permissions pinning, and runner hygiene cards — pipeline file from $DEVSEC_LAB only.
Visual · t36_pipeline_lab
Lab: pipeline security pack. $DEVSEC_LAB only. Original Cyberlium.
Opening
Pipeline pack merges Actions hygiene to pinning to runners — paperwork before SAST module.
Lessons 3-1–3-3 named GitHub Actions hygiene, permissions pinning, and runner hygiene. This lab merges three sections into one $DEVSEC_LAB pipeline artifact with M1 ethics and M2 fundamentals cross-references. No stranger-org workflows or production secret dumps — pipeline security paperwork only. Next: Quiz — Pipeline Security.
1. Lab contract: pipeline security pack
Create $HOME/cyberlium-lab/t36-m03-l04-pipeline-lab.txt merging Actions hygiene, pinning, and runner sections with $DEVSEC_LAB fictional workflow and M1/M2 cross-references.
Optional: link workflow file name to repo from M1 inventory.
Command guide
Try these commands — Lab contract: pipeline security pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ NIST SSDF PS.1 — https://csrc.nist.gov/Projects/ssdf GitHub secret scanning — https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cat > "$DEVSEC_LAB/notes/secret-scan-lab-summary.md" <<'EOF'
# Secret Scan Lab Summary — YOUR lab
- .env.example: FAKE secrets labeled FAKE — literacy only
- gitleaks detect on YOUR sample-repo tree
- .gitignore blocks real .env from accidental commit
## Next
- Wire gitleaks step into security.yml (Module 6)
## Refusals
- No real API keys; no scanning stranger GitHub orgs
EOFCommand — copy this
grep -E 'FAKE|Refusals|gitleaks' "$DEVSEC_LAB/notes/secret-scan-lab-summary.md" ls -la "$DEVSEC_REPO/" grep FAKE "$DEVSEC_REPO/.env.example" | wc -l
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/sample-repo/.env.example | Select-String FAKE Get-Content $HOME/cyberlium-lab/t36-devsec/notes/gitleaks-named.txt | Select-String detect
Primary tools to practice this lesson: grep, gitleaks. Reference sites: Gitleaks (https://gitleaks.io/); NIST SSDF PS.1 (https://csrc.nist.gov/Projects/ssdf); GitHub secret scanning (https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for production PATs, stranger org workflow copies, live credential dumps — remove. Confirm all examples use $DEVSEC_LAB fictional placeholders.
Workflow examples use placeholder secret names — no real tokens.
3. Lock the proof
chmod 600 on the pack. Quiz next — then SAST Named.
Pipeline security literacy feeds SAST and secrets lessons in M4.
4. What you ship: pipeline security pack for $DEVSEC_LAB
Merged Actions, pinning, runner sections. $DEVSEC_LAB named. NO stranger pipelines. chmod 600.
5. What you record before the next lesson
Date. Pipeline pack path. $DEVSEC_LAB named. File t36-m03-l04-pipeline-lab.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include production PAT in pack. Skip pinning section.
Right
Write YOUR pipeline security pack for $DEVSEC_LAB. chmod 600. Next: Quiz — Pipeline Security.
Mission: freeze YOUR pipeline security pack on disk
1) Merge M3 literacy sections. 2) Confirm zero production secrets or stranger-org refs. 3) Link M1/M2 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed pipeline pack beats ten over-privileged workflow YAMLs.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Pipeline pack should use least-privilege permissions examples.
True or False
Knowledge Check
APPLY: Pipeline pack supports:
Multiple choice