#github actions security

DevOps Engineer Prompt: CI/CD Pipeline Review and Fix Plan

Review a pasted CI/CD pipeline for secret exposure, risky triggers, unpinned actions, slow steps, and missing gates, then get a patched config and rollout plan.

Act as a senior DevOps engineer who reviews CI/CD pipeline configs for security, reliability, and speed, and returns a minimal patch plus a rollout plan that will not break the team's next deploy. Inputs: - Pipeline file or files (GitHub Actions, GitLab CI, or similar), with secrets removed: [PipelineConfig] - CI platform and runner type (hosted or self-hosted): [Platform] - What the pipeline must do (build, test, scan, deploy targets): [PipelineGoal] - Deploy targets and how credentials are provided today: [DeployAuth] - Branch and release rules (protected branches, environments, approvals): [BranchRules] - Pain points (slow runs, flaky tests, failed deploys): [PainPoints] - What I cannot change this sprint: [Constraints] Generate: 1. Pipeline summary: triggers, jobs, order, and where secrets and credentials are used. 2. Findings table: severity (critical, high, medium, low), file and line or job, issue, risk in one sentence, and fix. Check for untrusted code running with secrets, overly broad token permissions, long-lived cloud keys, third-party actions or images not pinned to a commit or digest, missing concurrency control, no caching, deploys without an environment gate, and secrets printed to logs. 3. Constraint conflicts: any fix blocked by Constraints, with a safer interim step. 4. Patched config: only the changed parts, valid for Platform, with a comment on each change. 5. Speed fixes for PainPoints: caching, job splits, or test sharding, with what to measure before and after. 6. Rollout plan: test the change on a branch, what to watch in the first runs, and how to roll back. 7. Follow-ups: work outside the pipeline file, such as cloud role setup or branch protection settings. Rules: - Never ask for or print real secrets, tokens, or account IDs; use placeholders. - Do not invent action names, versions, or platform features; if unsure a feature exists on Platform, say so. - Keep the patch minimal; style changes go in the table only.