[REVIEW] pipeline-security: add deploy-time attestation verification gates

[catcherintheroad-hub]

Skill Being Reviewed

Skill name: pipeline-security
Skill path: skills/devsecops/pipeline-security/

False Positive Analysis

Benign-looking pipeline that can be over-credited:

build:
  steps:
    - uses: actions/attest-build-provenance@v2
    - run: cosign sign $IMAGE_DIGEST
deploy:
  steps:
    - run: kubectl set image deploy/api api=$IMAGE_TAG

Why this is a false positive:

The build generates provenance and a signature, but the deploy stage does not verify the attestation subject digest, builder identity, issuer, source repository, workflow ref, or SLSA predicate before release. A report can credit SLSA/CICD-SEC-9 controls for producing evidence that is never enforced.

Coverage Gaps

Missed variant 1: tag deployment bypasses attested digest

The build attests sha256:abc, but deployment consumes repo/app:latest or a mutable tag.

Missed variant 2: signature exists but identity constraints are missing

cosign verify runs without checking issuer, subject, certificate identity, repository, workflow ref, or builder ID.

Missed variant 3: provenance is generated but not policy-enforced

No admission controller, deploy gate, or release policy rejects artifacts that lack valid provenance.

Edge Cases

• Internal artifacts may use private PKI instead of Sigstore, but still need issuer/subject and digest binding evidence.
• Development environments may warn-only, while production should enforce.
• Multi-arch images need manifest digest and per-platform provenance handling.

Remediation Quality

• Fix resolves the vulnerability
• Fix doesn't introduce new security issues
• Fix doesn't break functionality
• Issues found: Add attestation verification evidence gates for deploy-time digest binding, identity constraints, SLSA predicate validation, and policy enforcement.

Comparison to Other Tools

Tool	Catches this?	Notes
cosign / Sigstore	Partial	Can verify signatures and identities, but review must check command constraints and enforcement location.
SLSA provenance	Partial	Defines provenance expectations; deploy policy must consume the provenance.
Admission controllers	Partial	Kyverno/Gatekeeper/Connaisseur can enforce policies when configured.

Overall Assessment

Strengths: Strong SLSA and CICD-SEC-9 coverage for artifact signing, SBOM, digest pinning, and provenance generation.

Needs improvement: Add verification-side controls so generated attestations are bound to the deployed artifact and enforced before production release.

Priority recommendations:

1. Add a deploy/release attestation verification gate under CICD-SEC-9.
2. Require subject digest, issuer/cert identity, source repository/ref, builder identity, and SLSA predicate checks.
3. Add output fields for verification command/policy, enforcement mode, and exception owner.

Sources Checked

• SLSA v1.0: https://slsa.dev/spec/v1.0/
• Sigstore cosign verify: https://docs.sigstore.dev/cosign/verifying/verify/
• GitHub artifact attestations: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: GitHub Sponsors

[danyili2632]

/attempt #1372

I am taking a focused implementation pass for skills/devsecops/pipeline-security/ covering deploy-time attestation verification, digest-bound deployment, identity constraints, SLSA predicate checks, admission/release policy enforcement, multi-arch provenance handling, and exception owner evidence. Bounty target: Improver Moderate if accepted; preferred payment is Base USDC.

[danyili2632]

Implemented in PR #1389: #1389

What changed:

• Added deploy-time attestation verification gates under CICD-SEC-9.
• Required subject digest binding, verifier command/policy evidence, issuer/certificate identity constraints, source ref, builder ID, SLSA predicate validation, enforcement mode, exception governance, and multi-arch handling.
• Updated the report template with deploy-time verification evidence fields.

Validation completed:

• git diff --check clean (CRLF warning only)
• Markdown fence count balanced
• Required content markers present for deploy-time attestation verification, digest binding, identity constraints, SLSA predicate validation, enforcement mode, exception governance, multi-arch handling, and output evidence fields

Requested tier: Improver Moderate ($100) if accepted. Preferred payment: Base USDC.