Cilium

Securing CI/CD in Open Source Projects: Cilium’s Final Guide to Credentials, Verification, and Remaining Gaps

VK Cloud has published the third and final part of its translated Cilium series on protecting the software supply chain in open source projects. The article details how Cilium isolates CI and production credentials using separate GitHub environments, enforces keyless signing with Sigstore Cosign and SBOM attestations, and applies strict release controls that prevent compromised workflows from reaching production images. It also covers the team’s ongoing security operations, additional hardening measures such as immutable tags and mandatory DCO sign-offs, and a gap analysis against OpenSSF Scorecard and SLSA standards. The post examines GitHub’s 2026 Actions security roadmap and explains how planned platform features like dependency blocking, scoped secrets, and native egress firewalls align with Cilium’s existing controls. The piece concludes by emphasizing defense-in-depth and the importance of openly sharing supply-chain security practices across the open source community.