Your CI ran code it should not have, and you cannot prove it did not

Short summary

Recent supply chain attacks (trivy-action, litellm) exploited the gap between CI workflow YAMLs and actual code execution, leaving no signed record. CI/Lock closes this gap by tracing execution with ptrace/eBPF and signing evidence as in-toto attestations, creating verifiable proof of what ran. Human-signed policies ensure AI agents cannot unilaterally authorize releases, shifting from trusting environments to verifying cryptographic records.

• •Supply chain attacks used tag retagging and import-time code execution to evade CI workflow audits
• •CI/Lock wraps build commands and signs execution traces as in-toto DSSE attestations, creating tamper-proof evidence
• •Policy-based signing prevents autonomous agents from authorizing releases without human oversight

Generated with AI, which can make mistakes.