Sher: A Secure Broker for DevSecOps and CI/CD Workflows
- 1 School of Cybersecurity and Privacy, Georgia Institute of Technology, Atlanta, USA
- 2 School of Cybersecurity and Privacy, Georgia Institute of Technology, Atlanta, USA
Abstract
GitHub Actions, a popular CI/CD platform, introduces significant security challenges due to its integration with GitHub’s open ecosystem and its use of flexible workflow configurations. This paper presents <i>Sher</i>, a Python-based tool that enhances the security of GitHub Actions by automating the detection and remediation of security issues in workflows. Self-Hosted Ephemeral Runner, or Sher, acts as a broker between GitHub’s APIs and a customizable, isolated environment, analyzing workflows through a static rules engine and automatically fixing identified issues. By providing a secure, ephemeral runner environment and a dynamic analysis tool, Sher addresses common misconfigurations and vulnerabilities, contributing to the resilience and integrity of DevSecOps practices within software development pipelines.
- Oracle (2024) What is DevOps? https://www.oracle.com/devops/what-is-devops/
- Wikipedia (2024) GitHub. https://en.wikipedia.org/w/index.php?title=GitHub&oldid=1196345392
- GitHub Resources (2024) DevSecOps Explained. https://resources.github.com/devops/fundamentals/devsecops/
- Jenkins (2024) https://www.jenkins.io/
- Travis CI (2024) Test and Deploy with Confidence. https://www.travis-ci.com/
- Circle CI (2024) Build Anything Fast. The CI/CD Platform for the AI Future. https://circleci.com/
- GitLab (2024) GitLab CI-Documentation. https://docs.gitlab.com/ee/ci/
- GitHub (2024) What is Github Actions? https://web.archive.org/web/20211203130324/ https://resources.github.com/downloads/What-is-GitHub.Actions_.Benefits-and-examples.pdf
- Stawinski IV, J. (2024) Fixing Typos and Breaching Microsoft’s Perimeter. https://johnstawinski.com/2024/04/15/fixing-typos-and-breaching-microsofts-perimeter/
- GitHub (2024) GitHub Marketplace-GitHub Actions. https://github.com/marketplace?category=&query=updated:>2023-07-21 sort:popularity-desc&type=actions&verification
- GitHub (2024) Understanding GitHub Actions. https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions
- Epling, J. (2024) Powering Community-Led Innovation with GitHub Actions. https://github.blog/2019-11-14-powering-community-led-innovation-with-github-actions/
- Smart, I. and Gazdag, V. (2024) RCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline Compromise. https://www.blackhat.com/us-22/briefings/schedule/#rce-as-a-service-lessons-learned-from-5-years-of-real-world-cicd-pipeline-compromise-27541
- Stawinski IV, J. (2024) Playing with Fire—How We Executed a Critical Supply Chain Attack on Pytorch. https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/
- Khan, A. (2024) One Supply Chain Attack to Rule Them All—Poisoning GitHub’s Runner Images. https://adnanthekhan.com/2023/12/20/one-supply-chain-attack-to-rule-them-all/
- GitHub (2024) Events that Trigger Workflows. https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
- Chandramouli, R., Kautz, F. and Torres-Arias, S. (2024) Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-204D.pdf