{"id":13,"date":"2026-10-15T04:19:41","date_gmt":"2026-10-15T04:19:41","guid":{"rendered":"https:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/"},"modified":"2026-10-15T04:19:41","modified_gmt":"2026-10-15T04:19:41","slug":"zero-trust-cicd-slsa-ephemeral-runners-sigstore","status":"publish","type":"post","link":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/","title":{"rendered":"Zero-Trust CI\/CD Pipelines: Enforcing SLSA Level 3, Ephemeral Kube-Runners, and Keyless Sigstore Attestation"},"content":{"rendered":"<p>Software supply chain breaches have evolved from theoretical academic vectors into devastating enterprise realities. The high-profile compromises of SolarWinds, Codecov, and the critical near-miss of the <code>xz<\/code> backdoor proved that an attacker who compromises an organization&#8217;s continuous integration and continuous delivery (CI\/CD) pipeline effectively controls its entire runtime estate. Yet, inside many enterprise engineering teams, CI\/CD runners remain the soft underbelly of the cloud topology: long-lived virtual machines with cached credentials, ambient static AWS access tokens stored in plaintext environment secrets, and root-privileged Docker-in-Docker (DinD) engines capable of trivial container breakouts.<\/p>\n<p>Achieving true zero-trust in modern CI\/CD requires treating every build step as untrusted, every runner compute node as ephemeral and disposable, and every build artifact as counterfeit until proven otherwise via immutable cryptographic attestation. In this deep dive, we present an end-to-end architectural blueprint implemented for high-throughput enterprise environments: orchestrating isolated, single-use GitHub Actions runners via Kubernetes, eliminating long-lived credentials using OpenID Connect (OIDC) federation, generating Supply-chain Levels for Software Artifacts (SLSA) Level 3 build provenance with Sigstore Cosign, and enforcing cryptographically validated deployments via Kyverno policy-as-code.<\/p>\n<h2>The Threat Vector Matrix in High-Velocity Pipelines<\/h2>\n<p>Before applying controls, architects must model where modern CI\/CD pipelines fail under adversarial pressure. Vulnerabilities rarely stem from the build code itself; they emerge from the ambient trust granted to the CI execution environment.<\/p>\n<ul>\n<li><strong>Runner Persistence and Workspace Poisoning:<\/strong> Persistent or self-hosted runners that re-use directories across job executions allow an unprivileged pull request execution (such as a compromised unit test) to alter build scripts, leave backdoor binaries in shared caches, or read residual secrets left by preceding production deployment jobs.<\/li>\n<li><strong>Ambient Credential Exfiltration:<\/strong> Storing static <code>AWS_ACCESS_KEY_ID<\/code> and <code>AWS_SECRET_ACCESS_KEY<\/code> strings within repository secrets exposes them to arbitrary code execution during workflow dispatch, fork execution vulnerabilities, or malicious third-party GitHub Actions actions.<\/li>\n<li><strong>Privileged Container Runtimes:<\/strong> Traditional Docker-in-Docker patterns require running CI daemon containers in <code>--privileged<\/code> mode. Any remote code execution inside the build container gives the attacker access to the host&#8217;s Linux kernel, cgroups, devices, and adjacent Kubernetes workloads.<\/li>\n<li><strong>Unattested Artifact Tampering:<\/strong> A standard CI pipeline builds an image, tags it with a commit SHA, and pushes it to a container registry. Without cryptographic provenance tying the digest strictly to an authenticated, tamper-proof build pipeline, an attacker with compromised registry push credentials can overwrite or inject a malicious image digest undetected.<\/li>\n<\/ul>\n<p>The solution requires decoupling trust from network location, removing permanent credentials, and establishing strict cryptographic chain-of-custody from source commit to production pod admission.<\/p>\n<h2>Phase 1: Zero-State Ephemeral Compute with Actions Runner Controller (ARC)<\/h2>\n<p>To eliminate runner persistence and privilege escalation, runners must be completely ephemeral (destroyed after a single job execution) and run unprivileged without Docker daemon socket mounts. We achieve this by deploying GitHub&#8217;s modern Actions Runner Controller (ARC) based on <code>autoscaling-runner-set<\/code> on an isolated Amazon EKS or bare-metal Kubernetes cluster.<\/p>\n<p>Instead of relying on Docker-in-Docker, builds are executed using rootless container tooling such as Kaniko or Google&#8217;s <code>ko<\/code>. Below is a production Kubernetes manifest configuring an unprivileged, ephemeral <code>AutoscalingRunnerSet<\/code> running on dedicated nodes tainted for CI execution:<\/p>\n<pre><code>apiVersion: actions.github.com\/v1alpha1\nkind: AutoscalingRunnerSet\nmetadata:\n  name: hardened-ephemeral-runner\n  namespace: arc-runners\nspec:\n  githubConfigUrl: \"https:\/\/github.com\/studymorph\/enterprise-core\"\n  githubConfigSecret: arc-github-app-secret\n  minRunners: 2\n  maxRunners: 30\n  template:\n    spec:\n      serviceAccountName: arc-runner-sa\n      automountServiceAccountToken: false\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 10001\n        runAsGroup: 10001\n        fsGroup: 10001\n        seccompProfile:\n          type: RuntimeDefault\n      tolerations:\n        - key: \"dedicated\"\n          operator: \"Equal\"\n          value: \"ci-runners\"\n          effect: \"NoSchedule\"\n      affinity:\n        nodeAffinity:\n          requiredDuringSchedulingIgnoredDuringExecution:\n            nodeSelectorTerms:\n              - matchExpressions:\n                  - key: \"workload\"\n                    operator: \"In\"\n                    values: [\"isolated-ci\"]\n      containers:\n        - name: runner\n          image: ghcr.io\/actions\/actions-runner:latest\n          command: [\"\/home\/runner\/run.sh\"]\n          resources:\n            limits:\n              cpu: \"4\"\n              memory: \"8Gi\"\n              ephemeral-storage: \"20Gi\"\n            requests:\n              cpu: \"2\"\n              memory: \"4Gi\"\n              ephemeral-storage: \"10Gi\"\n          securityContext:\n            readOnlyRootFilesystem: true\n            allowPrivilegeEscalation: false\n            capabilities:\n              drop:\n                - ALL\n          volumeMounts:\n            - name: work\n              mountPath: \/home\/runner\/_work\n            - name: tmp\n              mountPath: \/tmp\n      volumes:\n        - name: work\n          emptyDir: {}\n        - name: tmp\n          emptyDir: {}\n<\/code><\/pre>\n<p>With this configuration, every workflow triggers an on-demand pod running as an unprivileged UID (10001). The pod filesystem is read-only, privileged escalation is blocked at the Linux kernel boundary, and once the job finishes, the pod is immediately deleted and reclaimed, preventing cross-build persistence and forensic evasion.<\/p>\n<h2>Phase 2: Ambient Credential Elimination via OpenID Connect (OIDC)<\/h2>\n<p>Static access keys must be explicitly outlawed in enterprise policy. By establishing an OpenID Connect (OIDC) trust relationship between the GitHub Actions token service and AWS Security Token Service (STS), ephemeral runners exchange a short-lived JSON Web Token (JWT) for temporary, scope-restricted IAM session credentials.<\/p>\n<h3>The OIDC Trust Policy: Precise Branch and Workflow Pinning<\/h3>\n<p>A frequent anti-pattern is establishing OIDC trust with wildcards across an entire GitHub organization. An enterprise trust policy must bind permissions strictly to the target repository, deployment environment, and reference branch. Below is the AWS IAM Role trust policy requiring an exact match on repository identity and production deployment context:<\/p>\n<pre><code>{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Federated\": \"arn:aws:iam::112233445566:oidc-provider\/token.actions.githubusercontent.com\"\n      },\n      \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"token.actions.githubusercontent.com:aud\": \"sts.amazonaws.com\",\n          \"token.actions.githubusercontent.com:iss\": \"https:\/\/token.actions.githubusercontent.com\"\n        },\n        \"StringLike\": {\n          \"token.actions.githubusercontent.com:sub\": \"repo:studymorph\/enterprise-core:environment:production\"\n        }\n      }\n    }\n  ]\n}\n<\/code><\/pre>\n<p>This policy guarantees that even if an attacker creates a branch or a pull request within the same organization, AWS STS will decline to issue credentials unless the job executes within the protected <code>production<\/code> environment gate (enforcing mandatory peer reviews and approvals).<\/p>\n<h2>Phase 3: Keyless Cryptographic Signing and SLSA Provenance with Sigstore<\/h2>\n<p>Traditional public-key cryptography in CI\/CD suffers from catastrophic key management problems: developers generate private GPG or RSA keys, store them in repository secrets, never rotate them, and fail to revoke them when engineers leave the company. If the signing key leaks, an adversary can sign malicious artifacts indefinitely.<\/p>\n<p>Sigstore modernizes this paradigm through <strong>Keyless Signing<\/strong> using three core primitives:<\/p>\n<ol>\n<li><strong>Fulcio:<\/strong> A lightweight, ephemeral Public Key Infrastructure (PKI) Certificate Authority that issues short-lived X.509 certificates (valid for roughly 10 minutes) bound to an authenticated OIDC identity (e.g., the GitHub Actions workflow).<\/li>\n<li><strong>Cosign:<\/strong> The command-line utility used to generate ephemeral key pairs, request certificates from Fulcio, sign the artifact digest, and store signatures in the container registry.<\/li>\n<li><strong>Rekor:<\/strong> An immutable, append-only cryptographic transparency ledger that logs the signature, certificate, and timestamp. Even if the short-lived certificate expires, Rekor provides cryptographic proof that the signature was generated during the certificate&#8217;s validity window.<\/li>\n<\/ol>\n<h3>Production Workflow: Rootless Build, Syft SBOM, and Cosign SLSA Attestation<\/h3>\n<p>Below is a production-grade GitHub Actions workflow demonstrating how to compile a container image rootlessly using Kaniko, extract its Software Bill of Materials (SBOM) using Syft, sign the digest keylessly, and attach an in-toto SLSA provenance attestation:<\/p>\n<pre><code>name: Secure Build &amp; Attestation Pipeline\n\non:\n  push:\n    tags:\n      - 'v*.*.*'\n\npermissions:\n  id-token: write # Required for OIDC federation with AWS and Sigstore Fulcio\n  contents: read\n  packages: write\n\njobs:\n  build-and-sign:\n    runs-on: [self-hosted, hardened-ephemeral-runner]\n    environment: production\n    steps:\n      - name: Checkout Source Code\n        uses: actions\/checkout@v4\n        with:\n          fetch-depth: 1\n\n      - name: Configure AWS Credentials via OIDC\n        uses: aws-actions\/configure-aws-credentials@v4\n        with:\n          role-to-assume: arn:aws:iam::112233445566:role\/github-actions-prod-ecr-publisher\n          aws-region: us-east-1\n          audience: sts.amazonaws.com\n\n      - name: Log in to Amazon ECR\n        id: login-ecr\n        uses: aws-actions\/amazon-ecr-login@v2\n\n      - name: Install Cosign and Syft\n        uses: sigstore\/cosign-installer@v3.5.0\n\n      - name: Setup Syft\n        uses: anchore\/sbom-action\/download-syft@v0.16.0\n\n      - name: Execute Rootless Image Build (Kaniko)\n        run: |\n          docker run --rm \n            -v $(pwd):\/workspace \n            gcr.io\/kaniko-project\/executor:latest \n            --dockerfile=Dockerfile \n            --context=dir:\/\/\/workspace \n            --destination=${{ steps.login-ecr.outputs.registry }}\/enterprise-core:${{ github.ref_name }} \n            --digest-file=\/workspace\/image-digest.txt\n\n      - name: Capture Image Digest\n        id: artifact\n        run: |\n          DIGEST=$(cat image-digest.txt)\n          IMAGE_URI=\"${{ steps.login-ecr.outputs.registry }}\/enterprise-core@${DIGEST}\"\n          echo \"image_uri=${IMAGE_URI}\" &gt;&gt; $GITHUB_OUTPUT\n          echo \"digest=${DIGEST}\" &gt;&gt; $GITHUB_OUTPUT\n\n      - name: Generate Software Bill of Materials (SBOM)\n        run: |\n          syft ${{ steps.artifact.outputs.image_uri }} -o spdx-json &gt; sbom.spdx.json\n\n      - name: Keyless Signing and SBOM Attestation with Cosign\n        env:\n          COSIGN_EXPERIMENTAL: \"1\"\n        run: |\n          # Sign the container image digest keylessly using GitHub OIDC identity\n          cosign sign --yes ${{ steps.artifact.outputs.image_uri }}\n\n          # Attach the generated SBOM as an in-toto predicate\n          cosign attest --yes \n            --type spdxjson \n            --predicate sbom.spdx.json \n            ${{ steps.artifact.outputs.image_uri }}\n\n          # Attest SLSA build provenance\n          cosign attest --yes \n            --type slsaprovenance \n            --predicate &lt;(echo &#039;{&quot;builder&quot;:{&quot;id&quot;:&quot;https:\/\/github.com\/studymorph\/actions\/runner&quot;},&quot;buildType&quot;:&quot;https:\/\/actions.github.com\/buildtypes\/v1&quot;}&#039;) \n            ${{ steps.artifact.outputs.image_uri }}\n<\/code><\/pre>\n<blockquote>\n<p><strong>Security Principle:<\/strong> Notice that signing is executed strictly against the immutable content addressable digest (<code>sha256:...<\/code>) rather than a mutable container tag. Tags can be changed or hijacked in registry storage; SHA-256 digests cannot.<\/p>\n<\/blockquote>\n<h2>Phase 4: Admission-Time Enforcement with Kyverno Policy-as-Code<\/h2>\n<p>Cryptographic attestations are completely useless if production clusters happily run unverified images. Security must fail closed at deployment time. We implement an admission-control boundary in Kubernetes using Kyverno.<\/p>\n<p>The Kyverno <code>ClusterPolicy<\/code> intercepts every pod admission request, verifies that the image digest has been signed keylessly by Sigstore, inspects the Rekor transparency log, and validates that the OIDC certificate subject matches our exact repository and workflow identity.<\/p>\n<pre><code>apiVersion: kyverno.io\/v1\nkind: ClusterPolicy\nmetadata:\n  name: enforce-trusted-supply-chain\n  annotations:\n    policies.kyverno.io\/title: Enforce Signed Images &amp; Verified Attestations\n    policies.kyverno.io\/category: Software Supply Chain Security\n    policies.kyverno.io\/severity: high\n    policies.kyverno.io\/subject: Pod\nspec:\n  validationFailureAction: Enforce\n  background: false\n  rules:\n    - name: verify-sigstore-signature\n      match:\n        any:\n          - resources:\n              kinds:\n                - Pod\n              namespaces:\n                - production\n                - payment-gateway\n      verifyImages:\n        - imageReferences:\n            - \"112233445566.dkr.ecr.us-east-1.amazonaws.com\/enterprise-core:*\"\n          attestors:\n            - entries:\n                - keyless:\n                    issuer: \"https:\/\/token.actions.githubusercontent.com\"\n                    subject: \"https:\/\/github.com\/studymorph\/enterprise-core\/.github\/workflows\/secure-build.yml@refs\/tags\/v*\"\n                    rekor:\n                      url: \"https:\/\/rekor.sigstore.dev\"\n          attestations:\n            - predicateType: \"https:\/\/spdx.dev\/Document\"\n              conditions:\n                - all:\n                    - key: \"{{ element.name }}\"\n                      operator: Equals\n                      value: \"enterprise-core\"\n<\/code><\/pre>\n<p>If a developer tries to apply a standard deployment, or if an attacker compromises cluster credentials and attempts to deploy an image built outside of this specific workflow, the Kubernetes API server rejects the request with an HTTP 403 Forbidden:<\/p>\n<pre><code>Error from server: admission webhook \"validate.kyverno.svc\" denied the request:\npolicy Pod\/production\/core-service-7f6c49877-k8qwd fails verification:\nimage 112233445566.dkr.ecr.us-east-1.amazonaws.com\/enterprise-core@sha256:d8c4...\nfailed signature verification: no valid signatures found matching the specified issuer and subject.\n<\/code><\/pre>\n<h2>Operational Performance and Architecture Trade-offs<\/h2>\n<p>Transitioning to rootless builds and strict attestation introduces structural trade-offs that systems architects must anticipate and optimize:<\/p>\n<h3>1. Build Performance without the Docker Daemon<\/h3>\n<p>Eliminating Docker-in-Docker stops container breakout vulnerabilities, but tools like Kaniko lack a shared local layer cache across ephemeral pods. Without mitigation, build times can increase by 300% to 500%.<\/p>\n<p><strong>Resolution:<\/strong> Implement registry-based caching using Kaniko&#8217;s <code>--cache=true<\/code> and <code>--cache-repo<\/code> flags, pointing to a dedicated Amazon ECR cache repository. Kaniko checks the remote registry for cached intermediate layers before recompiling, bringing build times down to parity with persistent Docker daemon environments.<\/p>\n<h3>2. Network Egress Hardening on CI Runner Pods<\/h3>\n<p>A compromised dependency (such as a poisoned npm or Composer package) executes malicious lifecycle scripts during <code>npm install<\/code> or <code>composer install<\/code>. If the runner pod has unrestricted outbound internet access, the script can exfiltrate source code, pull down secondary payloads, or establish a reverse shell.<\/p>\n<p><strong>Resolution:<\/strong> Apply strict Kubernetes <code>NetworkPolicy<\/code> resources or Cilium eBPF egress policies to CI runner namespaces. Allow egress exclusively to:<\/p>\n<ul>\n<li>The GitHub runner orchestration endpoints.<\/li>\n<li>The package registry mirrors (via internal artifactory or proxy).<\/li>\n<li>The cloud provider STS and ECR endpoints.<\/li>\n<li>The Sigstore Fulcio and Rekor public transparency infrastructures.<\/li>\n<\/ul>\n<p>Drop all other egress traffic by default. If an open-source dependency attempts to phone home to an unknown command-and-control IP, the connection is instantly reset at the Linux networking layer.<\/p>\n<h3>3. High-Availability Considerations for Sigstore<\/h3>\n<p>Relying on public Sigstore instances (<code>rekor.sigstore.dev<\/code> and <code>fulcio.sigstore.dev<\/code>) introduces an external dependency into your production deployment path. If Rekor experiences a degraded state, cluster admission controllers might block legitimate pod restarts during a horizontal scale event.<\/p>\n<p><strong>Resolution:<\/strong> Set Kyverno&#8217;s <code>failurePolicy: Fail<\/code> for deployment operations, but decouple pod restarts by verifying signatures during deployment creation rather than node-level pod rescheduling. For regulated banking or defense environments, host a private Sigstore stack (Enterprise Rekor, Fulcio, and Trillian) entirely within your private VPC boundary.<\/p>\n<h2>The Implementation Roadmap for Enterprise Engineering<\/h2>\n<p>Securing the continuous delivery machinery is not accomplished overnight. Engineering leaders should execute this transformation through a staged maturity model:<\/p>\n<ol>\n<li><strong>Week 1-2 (Credential Eradication):<\/strong> Audit all repository secrets. Replace every static cloud credential with AWS\/GCP OIDC federation. Revoke the old IAM keys and enforce branch protections on deployment roles.<\/li>\n<li><strong>Week 3-4 (Compute Hardening):<\/strong> Migrate off shared virtual machines. Deploy the Actions Runner Controller on a locked-down, multi-tenant Kubernetes cluster. Enforce non-root execution contexts and disable privileged containers.<\/li>\n<li><strong>Week 5-6 (Keyless Signing Pipeline):<\/strong> Integrate Cosign and Syft into baseline continuous integration templates. Generate SBOMs and push signatures to the registry alongside images. Run in <code>audit<\/code> mode to ensure all production artifacts are correctly signed without blocking releases.<\/li>\n<li><strong>Week 7-8 (Admission Enforcement):<\/strong> Deploy Kyverno or Open Policy Agent (OPA) Gatekeeper in production clusters. Transition image verification policies from <code>Audit<\/code> to <code>Enforce<\/code>. Verify alerting pipelines and establish playbooks for emergency break-glass procedures.<\/li>\n<\/ol>\n<h2>Conclusion: The Zero-Trust Imperative<\/h2>\n<p>Security architectures that treat CI\/CD systems as protected perimeter zones are obsolete. The modern threat landscape demands that we verify every stage of the software delivery process cryptographically and operationally. By combining <strong>ephemeral, unprivileged Kubernetes compute<\/strong>, <strong>OIDC credential federation<\/strong>, <strong>Sigstore keyless provenance<\/strong>, and <strong>Kubernetes admission-time enforcement<\/strong>, enterprise systems architects build an immutable software supply chain. Attackers who breach upstream dependencies or capture developer credentials find themselves contained in sandboxed environments, unable to push rogue binaries into clusters that refuse to run anything less than fully attested code.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.<\/p>\n","protected":false},"author":1,"featured_media":14,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[26,19,18,25,24],"class_list":["post-13","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops-security","tag-cloud-security","tag-devops","tag-kubernetes","tag-sigstore","tag-supply-chain-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7-RC1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Zero-Trust CI\/CD: Ephemeral Runners &amp; Sigstore Attestation | Study Morph<\/title>\n<meta name=\"description\" content=\"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Zero-Trust CI\/CD: Ephemeral Runners &amp; Sigstore Attestation | Study Morph\" \/>\n<meta property=\"og:description\" content=\"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.\" \/>\n<meta property=\"og:url\" content=\"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/\" \/>\n<meta property=\"og:site_name\" content=\"Study Morph Tech Journal \u2014 IT Consulting &amp; Engineering\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-15T04:19:41+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"795\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tubagus Putra Kencana\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tubagus Putra Kencana\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#article\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/\"},\"author\":{\"name\":\"Tubagus Putra Kencana\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/#\\\/schema\\\/person\\\/95920a6db16182bc43a3d8ef330679cd\"},\"headline\":\"Zero-Trust CI\\\/CD Pipelines: Enforcing SLSA Level 3, Ephemeral Kube-Runners, and Keyless Sigstore Attestation\",\"datePublished\":\"2026-10-15T04:19:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/\"},\"wordCount\":1610,\"image\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg\",\"keywords\":[\"Cloud Security\",\"DevOps\",\"Kubernetes\",\"Sigstore\",\"Supply Chain Security\"],\"articleSection\":[\"DevOps &amp; Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/\",\"url\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/\",\"name\":\"Zero-Trust CI\\\/CD: Ephemeral Runners & Sigstore Attestation | Study Morph\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#primaryimage\"},\"image\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg\",\"datePublished\":\"2026-10-15T04:19:41+00:00\",\"author\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/#\\\/schema\\\/person\\\/95920a6db16182bc43a3d8ef330679cd\"},\"description\":\"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.\",\"breadcrumb\":{\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#primaryimage\",\"url\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg\",\"contentUrl\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg\",\"width\":1200,\"height\":795},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Zero-Trust CI\\\/CD Pipelines: Enforcing SLSA Level 3, Ephemeral Kube-Runners, and Keyless Sigstore Attestation\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/#website\",\"url\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/\",\"name\":\"Study Morph Tech Journal \u2014 IT Consulting &amp; Engineering\",\"description\":\"Deep-dive architectural insights, system engineering case studies, and digital transformation best practices.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/#\\\/schema\\\/person\\\/95920a6db16182bc43a3d8ef330679cd\",\"name\":\"Tubagus Putra Kencana\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g\",\"caption\":\"Tubagus Putra Kencana\"},\"description\":\"Founder &amp; Principal Engineer at Study Morph. Specializing in modern web architecture, cloud systems, and scalable digital platforms.\",\"sameAs\":[\"http:\\\/\\\/localhost\\\/study-morph-baru\\\/blog\"],\"url\":\"http:\\\/\\\/studymorph.com\\\/blog\\\/author\\\/tubagus-putra-kencana\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Zero-Trust CI\/CD: Ephemeral Runners & Sigstore Attestation | Study Morph","description":"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/","og_locale":"en_US","og_type":"article","og_title":"Zero-Trust CI\/CD: Ephemeral Runners & Sigstore Attestation | Study Morph","og_description":"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.","og_url":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/","og_site_name":"Study Morph Tech Journal \u2014 IT Consulting &amp; Engineering","article_published_time":"2026-10-15T04:19:41+00:00","og_image":[{"width":1200,"height":795,"url":"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg","type":"image\/jpeg"}],"author":"Tubagus Putra Kencana","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Tubagus Putra Kencana","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#article","isPartOf":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/"},"author":{"name":"Tubagus Putra Kencana","@id":"http:\/\/studymorph.com\/blog\/#\/schema\/person\/95920a6db16182bc43a3d8ef330679cd"},"headline":"Zero-Trust CI\/CD Pipelines: Enforcing SLSA Level 3, Ephemeral Kube-Runners, and Keyless Sigstore Attestation","datePublished":"2026-10-15T04:19:41+00:00","mainEntityOfPage":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/"},"wordCount":1610,"image":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#primaryimage"},"thumbnailUrl":"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg","keywords":["Cloud Security","DevOps","Kubernetes","Sigstore","Supply Chain Security"],"articleSection":["DevOps &amp; Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/","url":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/","name":"Zero-Trust CI\/CD: Ephemeral Runners & Sigstore Attestation | Study Morph","isPartOf":{"@id":"http:\/\/studymorph.com\/blog\/#website"},"primaryImageOfPage":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#primaryimage"},"image":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#primaryimage"},"thumbnailUrl":"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg","datePublished":"2026-10-15T04:19:41+00:00","author":{"@id":"http:\/\/studymorph.com\/blog\/#\/schema\/person\/95920a6db16182bc43a3d8ef330679cd"},"description":"Eliminate static credentials and supply chain vulnerabilities by orchestrating ephemeral Kubernetes runners, AWS OIDC federation, Cosign keyless signing, and Kyverno admission controls.","breadcrumb":{"@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#primaryimage","url":"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg","contentUrl":"http:\/\/studymorph.com\/blog\/wp-content\/uploads\/2026\/10\/zero-trust-ci-cd-pipelines-enforcing-slsa-level-3-ephemeral-kube-runners-and-keyless-sigstore-attestation-cover.jpg","width":1200,"height":795},{"@type":"BreadcrumbList","@id":"http:\/\/studymorph.com\/blog\/zero-trust-cicd-slsa-ephemeral-runners-sigstore\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/studymorph.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Zero-Trust CI\/CD Pipelines: Enforcing SLSA Level 3, Ephemeral Kube-Runners, and Keyless Sigstore Attestation"}]},{"@type":"WebSite","@id":"http:\/\/studymorph.com\/blog\/#website","url":"http:\/\/studymorph.com\/blog\/","name":"Study Morph Tech Journal \u2014 IT Consulting &amp; Engineering","description":"Deep-dive architectural insights, system engineering case studies, and digital transformation best practices.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/studymorph.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"http:\/\/studymorph.com\/blog\/#\/schema\/person\/95920a6db16182bc43a3d8ef330679cd","name":"Tubagus Putra Kencana","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e3030f9ebf657d3c71681da0b8b893e64ad0d8ee62a7e35d8048b3fe1eb8ba0e?s=96&d=mm&r=g","caption":"Tubagus Putra Kencana"},"description":"Founder &amp; Principal Engineer at Study Morph. Specializing in modern web architecture, cloud systems, and scalable digital platforms.","sameAs":["http:\/\/localhost\/study-morph-baru\/blog"],"url":"http:\/\/studymorph.com\/blog\/author\/tubagus-putra-kencana\/"}]}},"_links":{"self":[{"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/posts\/13","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/comments?post=13"}],"version-history":[{"count":0,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/posts\/13\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/media\/14"}],"wp:attachment":[{"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/media?parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/categories?post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/studymorph.com\/blog\/wp-json\/wp\/v2\/tags?post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}