BYTEHERDERA control you cannot fail a build on is not a control. It is a report.
What this covers
CI/CD architecture, build isolation and reproducibility, dependency and container scanning, SBOM generation and, more to the point, SBOM consumption, artifact signing and provenance attestation, policy as code at admission, secrets handling, and the release path from merge to running workload.
It also covers the parts of that path that happen outside CI, because those are usually where the interesting gaps are.
Scanners that report and never block are theatre.
Nearly every pipeline we inherit has a scanning stage, and nearly none of them can fail. The finding lands on a dashboard, the dashboard grows, and the release ships regardless. A better scanner does not fix that. Deciding in advance, in writing, which findings stop a release does, and then wiring that decision into the pipeline so the machine enforces it and people review it. SBOMs work the same way: generating one is a checkbox, having a policy that reads it at admission time is a control.
When this is the right work
- Security findings pile up in a dashboard nobody is accountable for closing.
- Compliance evidence for ISO 27001, BIO, NIS2 or SOC 2 is gathered by hand, quarterly, under pressure.
- Nobody can say with certainty which commit produced the image running in production right now.
- Secrets live in CI variables, and rotating one means an afternoon of grep.
- Release is a manual ritual that two people know how to perform.
- A supply-chain question from a customer takes a week to answer.
What changes
A release carries its own evidence: the source it came from, what ran against it, who signed it and under which policy it was admitted. Rotating a secret becomes routine. Producing an audit answer becomes a query rather than a project.
The path from merge to production is one path, and it is the only one. That single fact removes more risk than most tooling does.
How we work on it
Map the real release path first, including the manual steps people are slightly embarrassed about. Decide what must be true before an artifact reaches production. Implement those checks where they can block. Then test that they block, because an untested gate is an assumption wearing a badge.
Tools we tend to reach for
Chosen per problem, not per fashion. This is what the shelf looks like.