--- title: "Securing CI/CD for an open source project: lessons from Cilium" url: https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-lessons-from-cilium-eg8g6oivq source_url: https://cilium.io/blog/2026/05/06/securing-cicd-open-source-lessons-from-cilium type: article source: "cilium" published: 2026-05-06T14:57:49.173Z updated: 2026-05-06T14:58:15.502Z tags: ["security", "cicd", "github-actions", "cilium"] reading_time: 23 upvotes: 79 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Securing CI/CD for an open source project: lessons from Cilium **[cilium](https://daily.dev/sources/cilium)** · 23 min read · 79 upvotes · 0 comments ## Summary Cilium's security team details how they harden their CI/CD pipeline against supply chain attacks. Key controls include: SHA-pinned GitHub Actions and container images, a custom bot (Ariane) restricting who can trigger builds, two-phase checkouts for pull_request_target workflows to isolate untrusted code, Go module vendoring so dependency changes appear as reviewable diffs, CODEOWNERS gates on all .github/ changes, Renovate with a 5-day cooldown for automated dependency updates, static analysis via actionlint and CodeQL to catch expression injection and missing permissions, CI vs. production credential isolation using protected environments, and keyless Sigstore Cosign signing with SBOM attestations. The post also honestly documents remaining gaps: no SLSA provenance, no govulncheck in CI, 68 internal @main references, and no dependency-review-action. It closes with a look at GitHub's 2026 Actions security roadmap and how planned features like dependency locking, scoped secrets, and native egress firewalls map to current workarounds. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Securing CI/CD for an open source project: Controlling who runs what](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-controlling-who-runs-what-tfpbpm5iv) · CNCF · 7 upvotes · 1 comments - [Securing CI/CD for an open source project, part 3: Credentials, verification, and what’s next](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-part-3-credentials-verification-and-what-s-next-r3kcnm0ea) · CNCF · 8 upvotes · 0 comments - [Securing CI/CD for an open source project: Locking down dependencies](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-locking-down-dependencies-so0u2d8g2) · CNCF · 25 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#cilium](https://daily.dev/tags/cilium) [View this post on daily.dev](https://daily.dev/posts/securing-ci-cd-for-an-open-source-project-lessons-from-cilium-eg8g6oivq)