Software supply chain security: a working baseline
Practical controls for dependencies, CI/CD identities, build artifacts and third-party change.
Software supply chain security is the work of knowing what enters a product, controlling how it is built and being able to respond when an upstream component changes.
A useful baseline connects inventory, identity and evidence. A scanner by itself is not a supply chain programme.
Know what is shipped
Lock direct dependencies and review changes to the lockfile. Remove packages that no longer earn their place. Automate vulnerability and licence checks, but give findings an owner and a response path.
A software bill of materials can make incident response faster when it is generated from the actual build. It should identify direct and transitive components and stay linked to the released artifact.
Treat the pipeline as production
Build and deployment identities should use least privilege. Prefer short-lived credentials and separate the authority for development, preview and production environments.
Pin third-party workflow actions or plugins to an immutable version. Protect workflow changes through review, especially when a pull request can alter the code that receives secrets.
Use isolated, disposable runners for sensitive builds when possible. Limit network access and secret exposure to the steps that need them.
Make artifacts identifiable
Build once and promote the same artifact between environments. Store artifacts in an immutable location and attach enough provenance to identify the source revision, build process and dependencies.
Signing can strengthen this chain, but only if verification happens before deployment and the signing identity itself is protected.
Plan the response before an advisory
For an important dependency, know who can answer four questions: Are we affected? Where is it deployed? Is a safe version available? How will we verify and release the change?
Practise that path with a non-urgent update. It exposes missing ownership and environment drift before a time-sensitive incident.
Include services and vendors
Hosted services, build platforms and external APIs are production dependencies too. Record what data and authority they receive, how access is removed and what happens if the service is unavailable or changes materially.
The baseline is working when a team can identify what it shipped, reproduce how it was built and change a risky component without improvising the entire process.