The original title is 9 words: "Cilium publishes its CI hardening playbook, gaps and all"

Short summary

Cilium published a detailed CI/CD hardening guide covering credentials, artifact verification, and container signing. The key innovation is keyless OIDC signing—anchoring trust in workflow identity rather than long-lived maintainer keys—reducing exposure when credentials are compromised. The team also publicly listed unfinished security gaps, modeling transparency in open-source supply chains.

• •Keyless OIDC signing anchors trust in workflow identity instead of long-lived maintainer credentials
• •Container images and Helm charts are signed with Sigstore Cosign and attested with SBOMs
• •Team publicly documented remaining gaps including missing SLSA provenance and action pinning

Generated with AI, which can make mistakes.