The reference for CI/CD security is https://cybersecurity.cd.foundation/docs/.

And that’s it.

There isn’t more in this post. I said it in the past: I sometimes use this blog to take notes that are useful to me. I hope they’re useful to you too as well.
In this case it is a guide to consult when making DevSecOps decisions. “Consult” means “look up information”, not “accept blindly”.

Happy pipelining!