AI-Assisted Secure Coding (Appendix C) · CI/CD Pipeline Hardening Specific to AI Augmentation
Security review for workflow file changes
Verify that changes to workflow definition files (`.github/workflows/*`, `.gitlab-ci.yml`, `Jenkinsfile`, Argo, Tekton, and equivalents) are detected on every PR and route through an elevated review path that includes a security reviewer, regardless of who the contributor is or whether AI was involved. AI agents must not be granted bypass authority over this review path.
OWASP AISVS v1.01, requirement AC.12.5
In plain English
Detect changes to workflow definition files on every PR and send them through a review that includes a security reviewer, whoever made them. AI agents get no bypass.
What good looks like
- Workflow file changes are detected automatically.
- They require security review.
- No agent can bypass the review.
How teams usually do it
- CODEOWNERS for workflow paths and rulesets without bot bypass.
Evidence an auditor would accept
- CODEOWNERS and rulesets.
Common mistakes
- Reusable workflows in another folder not covered by the rule.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.