Supply Chain Security
Supply chain security protects the dependencies, build systems, and distribution channels that produce software, from lockfiles and pinned CI actions to SBOMs and provenance.
Definition
Supply chain security is the set of controls that protect the software production path: source dependencies, build tools, CI runners, artifacts, and distribution. It includes lockfiles, dependency auditing, pinned actions, least-privilege CI tokens, reproducible builds, SBOMs, artifact signing, and provenance verification. The goal is to know what is in the artifact and to prevent unauthorized code from entering the build.
Context and scope
Supply chain security is used by any team that installs third-party packages or runs CI/CD. The risk ranges from a vulnerable transitive dependency to a compromised build tool or a malicious package release.
Common misconceptions
- Auditing dependencies is enough — the build system, CI credentials, and artifact distribution are also attack surfaces
- A lockfile guarantees integrity — it pins versions but not the trustworthiness of the package or registry
- Signing an artifact proves it is safe — it proves origin and integrity, not the absence of vulnerabilities
Anti-patterns
- CI workflows using mutable action tags with repository write tokens
- Installing dependencies from untrusted registries without integrity checks
- Shipping build artifacts without an SBOM or provenance record
Related concepts
Related examples
Authoritative source
The build is part of the product
An application is the sum of its source, dependencies, build tools, and CI environment. An attacker can compromise any of them. A malicious transitive package, a retagged GitHub Action, or a leaked CI token can insert code that never appears in a normal code review. Supply chain controls make each step visible and constrained.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
permissions:
contents: readThe example pins an action and limits the workflow token. Both reduce the impact of a compromised dependency or workflow.
Know what you ship
Generate an SBOM from the final artifact, not only from the lockfile. Scan it for known vulnerabilities and triage by reachability and severity. Record the build inputs and provenance so a later investigation can answer which source and dependencies produced a deployed image. Sign artifacts and verify signatures at deployment where the platform supports it.
Least privilege for automation
CI tokens are high-value credentials. Grant only the permissions the workflow needs, avoid exposing secrets to pull requests from forks, and separate build and deploy roles. Rotate credentials and prefer short-lived workload identity. A compromised build step with repository write access can rewrite source or release artifacts.
When to use it
Use supply chain controls for any production software that depends on third-party code or automated builds. The advantage is a verifiable, constrained production path; the drawback is tooling and process overhead. Compared to dependency auditing alone, a supply chain program covers the build and distribution layers where audits cannot see.