Secure-Cicd-Courses

Review a dependency change, record its risk, and generate a CycloneDX SBOM before releasing software.

Reduce GitHub Actions token scope, separate untrusted jobs, and turn OpenSSF Scorecard findings into release controls.

Test dependency, SBOM, pipeline, Scorecard, provenance, attestation, and tampered-release decisions before viewing the separate answer key.

Check and explain the ten Secure CI/CD course questions before the release gate capstone.

Build and defend a release decision with dependency evidence, SBOM scope, pipeline permissions, provenance policy, and a tampering test.

Compare a completed local release decision packet with the Secure CI/CD capstone evidence and decision rules.

Read SLSA build provenance, create a GitHub artifact attestation, and verify digest, source, and workflow identity.

Run a local release verification lab, detect a modified artifact, and explain why trusted checksums and attestation identities matter.