Article citationsMore>>

Koishybayev, I., Nahapetyan, A., Zachariah, R., Muralee, S., Reaves B., Kapravelos A. and Machiry, A. (2022) Characterizing the Security of Github CI Workflows. Proceedings of the 31st USENIX Symposium, Boston, 10-12 August 2022, 2747-2763.

has been cited by the following article:

• TITLE: Sher: A Secure Broker for DevSecOps and CI/CD Workflows

  AUTHORS: Pranau Kumar, Vijay K. Madisetti

  KEYWORDS: CI/CD Pipelines, GitHub, GitOps, DevSecOps, Isolation, Security, SAST

  JOURNAL NAME: Journal of Software Engineering and Applications, Vol.17 No.5, May 29, 2024

  ABSTRACT: GitHub Actions, a popular CI/CD platform, introduces significant security challenges due to its integration with GitHub’s open ecosystem and its use of flexible workflow configurations. This paper presents Sher, a Python-based tool that enhances the security of GitHub Actions by automating the detection and remediation of security issues in workflows. Self-Hosted Ephemeral Runner, or Sher, acts as a broker between GitHub’s APIs and a customizable, isolated environment, analyzing workflows through a static rules engine and automatically fixing identified issues. By providing a secure, ephemeral runner environment and a dynamic analysis tool, Sher addresses common misconfigurations and vulnerabilities, contributing to the resilience and integrity of DevSecOps practices within software development pipelines.