143 reputation
5
bio website florentguilleux.fr
location Lima, Peru
age
visits member for 2 years, 1 month
seen Sep 26 at 16:32

Software engineer at Intellum


Sep
24
awarded  Autobiographer
Dec
6
awarded  Supporter
Sep
26
awarded  Scholar
Sep
26
accepted How to mitigate the risk of a continuous integration service security breach?
Sep
14
revised How to mitigate the risk of a continuous integration service security breach?
clarify the goal of the architecture
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
Thanks for your detailed answer bethlakshmi, I have edited my question to clarify that the main goal of the new architecture is too move the risk from the CI SaaS to a server of ours.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
When pinging the deploy server only an existing commit of the production branch can mentioned, so hopefully an attacker should not be able to force the deploy server to deploy any code he wants.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
The main difference between our deploy server and the CI service is that we control the deploy server while the CI service is as SaaS over which we have no control. The Heroku credentials are indeed critical and we prefer to have them hosted in a server of ours rather than on a SaaS.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
We do, our CI setup is a way to make sure the test suite is ran before the code is pushed to production even when we forget to do it manually.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
We are using a CI SaaS, the solution I explain in the question is made to not have the CI machine able to push code. Thanks for the race condition, had not thought about that, to prevent it will have the CI Saas ping the deploy server by specifying the exact commit(s) to deploy.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
Having one of our developer machine getting breached is always a risk, we want to mitigate the additional risk of having a breach on a service (the CI service) over which we have no control.
Sep
14
awarded  Editor
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
Yes we want :) That happens when one of us merges code in the production branch and push it to our central git repository. From this point we want the deploy to be automated. I've edited my question to clarify this point.
Sep
14
revised How to mitigate the risk of a continuous integration service security breach?
added 36 characters in body
Sep
13
awarded  Student
Sep
13
asked How to mitigate the risk of a continuous integration service security breach?