Draft Recommendations for Securing SaaS CI/CD Platforms

[tohch4]

As a Flexion engineer, in order to be confident in the sanity and safety of my build artifacts and related data, I would like guidance on how to properly configure SaaS CI/CD platforms, including, but not exclusively limited to:

• Github Actions
• CircleCI
• Travis

[tohch4]

As discussed in November 5, 2020 Security Guild, we should look into guidance on:

• Github Actions itself and potentially:
  • secrets storage
  • secure command syntax in their YAML specification
  • ancillary services:
    • Github Container Registry
    • Github Registry (for package manager for language runtimes)
    • Github Storage
• CircleCI
• Travis