TITLE:
Sher: A Secure Broker for DevSecOps and CI/CD Workflows
AUTHORS:
Pranau Kumar, Vijay K. Madisetti
KEYWORDS:
CI/CD Pipelines, GitHub, GitOps, DevSecOps, Isolation, Security, SAST
JOURNAL NAME:
Journal of Software Engineering and Applications,
Vol.17 No.5,
May
29,
2024
ABSTRACT: GitHub Actions, a popular CI/CD platform, introduces significant security challenges due to its integration with GitHub’s open ecosystem and its use of flexible workflow configurations. This paper presents Sher, a Python-based tool that enhances the security of GitHub Actions by automating the detection and remediation of security issues in workflows. Self-Hosted Ephemeral Runner, or Sher, acts as a broker between GitHub’s APIs and a customizable, isolated environment, analyzing workflows through a static rules engine and automatically fixing identified issues. By providing a secure, ephemeral runner environment and a dynamic analysis tool, Sher addresses common misconfigurations and vulnerabilities, contributing to the resilience and integrity of DevSecOps practices within software development pipelines.