Pipeline security lessons from March supply chain incidents

This post details how GitLab's Pipeline Execution Policies (PEPs) can be used to address recent supply chain attacks targeting CI/CD pipelines. It explains three attack patterns: poisoned tools/actions, packaging misconfigurations, and vulnerabilities in transitive dependencies. It then introduces specific PEPs like 'Artifact Hygiene' and 'Dependency Integrity' as solutions, demonstrating how they inject mandatory jobs into pipelines to validate package contents, check for malicious files, enforce package size limits, and compare dependency checksums against known-good states. The post also highlights the open-source 'Supply Chain Policies' project for ready-to-use PEPs.