OWASP CI/CD and Supply Chain Cheat Sheets

1. CI/CD Security

   Pipeline hardening, runner isolation and least-privilege tokens.

2. GitHub Actions Security

   Pinning actions, GITHUB_TOKEN permissions and script injection.

3. Infrastructure as Code Security

   Scanning IaC, state file secrets and policy as code.

4. Software Supply Chain Security

   Dependency, build and artifact supply chain controls.

5. Dependency Graph and SBOM

   Generating and using SBOMs and dependency graphs.

6. Vulnerable Dependency Management

   Triage and remediation of vulnerable dependencies.

7. Secure Cloud Architecture

   Cloud design patterns for security.

8. Serverless and FaaS Security

   Function permissions, event injection and secrets.

9. Workload Identity Federation

   Short-lived federated credentials instead of static keys.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.