Term Kind Topic What it is
Fork-Triggered Build Privileged Trigger, Pwn Request concept Pipeline Secrets A continuous-integration trigger that runs a workflow in the base repository's privileged context while its inputs come from an outside contributor - so the pipeline executes attacker-authored code with its ow…
Pipeline Credential Scope OIDC Federation for CI, Workload Identity for CI practice Pipeline Secrets Granting a pipeline short-lived, narrowly scoped identity for exactly the environment it is deploying to, rather than a long-lived key.
Untrusted Build Step Third-Party CI Step, Curl-Pipe-Shell Step concept Pipeline Secrets Any pipeline step whose code you do not control and did not review - a downloaded script, a third-party action, a plugin - which runs with the whole job's credentials and network access.
Workload Identity Federation protocol Pipeline Secrets A pipeline proving what it is with a short-lived signed token from its own platform, so no long-lived cloud credential is ever stored.