# Example: generating SLSA provenance in GitHub Actions
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
  with:
    base64-subjects: "${{ needs.build.outputs.hashes }}"

# Cosign: container image signing
# Sign an image
cosign sign --key cosign.key REGISTRY/IMAGE:TAG

# Verify an image
cosign verify --key cosign.pub REGISTRY/IMAGE:TAG

# Keyless signing with OIDC (no key management needed)
cosign sign REGISTRY/IMAGE:TAG
# Authenticates via your OIDC identity (GitHub, Google, etc.)

# In Kubernetes: Kyverno policy to only allow signed images
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  rules:
  - name: verify-cosign
    match:
      any:
      - resources:
          kinds:
          - Pod
    verifyImages:
    - imageReferences:
      - "registry.company.com/*"
      attestors:
      - entries:
        - keyless:
            subject: "https://github.com/company/*"
            issuer: "https://token.actions.githubusercontent.com"

# GitHub Actions: always use GitHub-hosted runners for public repos
runs-on: ubuntu-latest  # Ephemeral, clean environment per job

# Self-hosted runners: configure as ephemeral
# ./config.sh --ephemeral
# Runner is de-registered after each job and recreated

# Docker-based ephemeral runners
# Each job runs in a fresh container
# No cross-job contamination possible

# GitHub Actions: minimal GITHUB_TOKEN permissions
permissions:
  contents: read
  packages: write
  # Only what is needed, nothing more

# GitLab CI: use scoped variables
variables:
  DEPLOY_TOKEN:
    value: $CI_DEPLOY_TOKEN
    # protected: only available on protected branches
    # masked: hidden in build logs

# Jenkins: use credential scoping
// Jenkinsfile
withCredentials([
    usernamePassword(
        credentialsId: 'deploy-staging',  // Specific per environment
        usernameVariable: 'USER',
        passwordVariable: 'PASS'
    )
]) {
    // Credentials only available in this block
    sh 'deploy.sh'
}

# AWS OIDC with GitHub Actions (no long-lived credentials)
# Step 1: Configure the OIDC provider in AWS
# Step 2: Create an IAM role with trust policy
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::ACCOUNT:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:ORG/REPO:ref:refs/heads/main"
                }
            }
        }
    ]
}

# Step 3: Use in the workflow
# - uses: aws-actions/configure-aws-credentials@v4
#   with:
#     role-to-assume: arn:aws:iam::ACCOUNT:role/GitHubActionsRole
#     aws-region: eu-west-1
# No AWS_ACCESS_KEY_ID, no AWS_SECRET_ACCESS_KEY
# Only a short-lived session token

# GCP Workload Identity Federation with GitHub Actions
# Similar principle: OIDC token → GCP service account
- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/PROJECT_NUM/locations/global/workloadIdentityPools/github/providers/github-provider'
    service_account: 'github-actions@PROJECT.iam.gserviceaccount.com'

// Jenkinsfile: credentials scoped per folder, not global
withCredentials([
    usernamePassword(
        credentialsId: 'deploy-prod',  // Folder-scoped credential
        usernameVariable: 'DEPLOY_USER',
        passwordVariable: 'DEPLOY_PASS'
    )
]) {
    // Credentials only available in this block
    sh 'deploy.sh --user $DEPLOY_USER --pass $DEPLOY_PASS'
}
// Outside the block the variables are no longer available

// Pipeline as code: restrict what pipelines may do
// Configure in Manage Jenkins → Configure Global Security
// → Authorization → Project-based Matrix Authorization Strategy

// Example: Sandbox for untrusted pipelines
properties([
    // Restrict which agents this pipeline may use
    pipelineTriggers([]),
    disableConcurrentBuilds()
])