#ci-cd

2 posts

Your CI/CD Pipeline Is an Unmonitored Production Environment

XZ, tj-actions, Shai-Hulud, Codecov all owned the build, not the code. Scanning is blind to a poisoned build in flight. Detect the runner instead.

Most teams 'do DaC' by putting Sigma in a repo. That's the easy 20%. The capability that scales is a tested lifecycle, not a toolchain.