SignPath

Pipeline Policies

Available for Pipeline Integrity, Open Source Code Signing.

Pipeline policies allow restricting source code and build settings of your CI/CD pipeline.

Steps to create a Pipeline Policy:

  1. In SignPath, create a Pipeline Policy with either an internal definition, i.e. YAML pasted in the web interface or an external definition stored in a source code repository.
  2. For each signing policy, one or more pipeline policies can be added. At submit time, the build system and source code management system settings are evaluated and compliance with the policy definition is checked. If the level is set to Log, a respective information entry is shown on the signing request page. If the level is set to Enforce, the signinig request is denied.

Example

github-build-policies:
  version: '1.0'
  disallow_reruns: false
  runners:
    require_github_hosted: true
    allowed_groups:
      - Hardened Runners

github-scm-policies:
  version: '1.0'
  ruleset_constraints:
  - enforced_from: 2025-01-01
    allow_bypass_actors: true
    rules:
      - type: non_fast_forward
      - type: pull_request
        parameters:
          required_approving_review_count: 2
          require_last_push_approval: true

Reference

Pipeline Policies for the following systems are supported. See the respective pages for details:

  • Source Code Management (SCM) systems:
    • GitHub (github-scm-policies)
  • CI/CD systems: