Trusting the build pipeline

A CI job holds every credential you own and, on a public repo, runs code proposed by strangers. This guide reconstructs seven incidents (Codecov, CircleCI, Nx, tj-actions, Salesloft, Travis, PyTorch) into three repeating failure classes, shows why encryption and process cannot fix a long-lived secret in a build job, and lays out the per-job OIDC identity model the platforms are now shipping as the default. A reader can leave able to audit their own pipelines against the three classes and choose the authentication path per job.

What you get out of it

• One long-lived secret in a build job equals total compromise; encryption at rest is irrelevant because CI must decrypt to use it (CircleCI extracted keys from a running process).
• The seven incidents collapse into three classes: the standing secret, the pwn request, and the confused deputy; the third is introduced by the OIDC fix itself when the subject claim is bound loosely.
• Moving to keyless OIDC does not remove risk, it moves it from token theft to trust-policy misconfiguration; a missing sub condition left 500+ AWS roles across 275 accounts assumable by any repository.
• A mutable tag is not a version: the tj-actions attacker moved v1..v45 to a malicious commit and 23,000 repos picked it up; pin actions to a full commit SHA.
• The academic scans explain why defaults, not diligence, are the fix: 99.8% of workflows are overprivileged and code injection is pervasive, so only a platform default change scales.

Scope

Why this, now. The 2025 tj-actions and Nx supply-chain attacks, and GitHub's 2025-2026 platform changes deprecating standing npm tokens and disabling pwn-request defaults, make this the quarter the industry default actually shifts from static secrets to federated identity.

What it does not cover. Package and dependency integrity as such (typosquatting, malicious transitive dependencies, the Shai-Hulud worm mechanics), the human-endpoint malware that seeds some incidents, and artifact signing beyond where it touches CI identity.