# Securing CI/CD with Chainguard

URL: https://chainguard-docs-preview-git-1016-404s.chainguard.app/software-security/learning-labs/ll202604.md
Last Modified: September 28, 2026
Tags: Learning Labs, Chainguard Actions

Learning lab for April 2026 on recent software supply chain incidents in GitHub Actions and how to leverage Chainguard products and tools to mitigate risks


The April 2026 Learning Lab with Erika Heidi goes through how attackers exploit vulnerable GitHub Actions workflows, and how Chainguard can protect your CI/CD pipelines from these threats.
[Watch the video on YouTube](https://www.youtube.com/watch?v=D9tORVR4H9g)


## Sections

- [0:00](https://www.youtube.com/watch?v=D9tORVR4H9g) Introduction and agenda
- [5:31](https://www.youtube.com/watch?v=D9tORVR4H9g&t=331s) Timeline of CI/CD software supply chain incidents
- [11:25](https://www.youtube.com/watch?v=D9tORVR4H9g&t=685s) Open Source and CI/CD as the new target
- [12:47](https://www.youtube.com/watch?v=D9tORVR4H9g&t=767s) 2026: the year of AI-assisted attacks
- [15:16](https://www.youtube.com/watch?v=D9tORVR4H9g&t=916s) Unpacking the Trivy Compromise
- [19:57](https://www.youtube.com/watch?v=D9tORVR4H9g&t=1197s) Secret exfiltration live demo
- [36:17](https://www.youtube.com/watch?v=D9tORVR4H9g&t=2177s) What could unfold from here
- [39:04](https://www.youtube.com/watch?v=D9tORVR4H9g&t=2344s) Strategies to mitigate risks
- [39:24](https://www.youtube.com/watch?v=D9tORVR4H9g&t=2364s) Repository inspection for insecure defaults
- [44:03](https://www.youtube.com/watch?v=D9tORVR4H9g&t=2643s) Minimize attack surface
- [48:48](https://www.youtube.com/watch?v=D9tORVR4H9g&t=2928s) Pull from trusted sources
- [52:21](https://www.youtube.com/watch?v=D9tORVR4H9g&t=3141s) Pin by digest
- [54:28](https://www.youtube.com/watch?v=D9tORVR4H9g&t=3268s) Use short lived tokens (ban PATs)
- [55:32](https://www.youtube.com/watch?v=D9tORVR4H9g&t=3332s) Use Chainguard Actions
- [58:55](https://www.youtube.com/watch?v=D9tORVR4H9g&t=3535s) Closing notes

## Resources

- [Slide deck](/downloads/learning-lab-securing-cicd-202604.pdf)
- [Chainguard Containers](/chainguard/containers/overview/)
- [Chainguard Libraries](/chainguard/libraries/introduction/overview/)
- [Chainguard Actions](https://www.chainguard.dev/actions)
- [Digestabot](https://github.com/marketplace/actions/update-the-image-digest)
- [Octo-STS](https://github.com/apps/octo-sts)