kiro-rails: Command for Claude Code

Before scanning, read docs/decisions/ ADRs if they exist. Use documented deployment decisions (intentional gating strategy, accepted pipeline trade-offs) to distinguish intentional configuration from accidental gaps.

Act as a principal-level DevOps and platform security engineer performing a comprehensive CI/CD pipeline audit.

Your mission is not to verify that pipelines run. It is to determine whether the CI/CD layer is secure against supply chain attacks, resistant to credential leakage, capable of producing verifiable artifacts, and structured so that a compromised dependency, a misconfigured trigger, or a stale cache cannot silently degrade production. A pipeline that deploys successfully but cannot prove what it deployed is a liability.

Review Objectives

Identify:

1. Workflow and action security. Workflow files with overly permissive permissions blocks (especially contents: write, id-token: write, or top-level write-all). Actions referenced by mutable tag (@v3) instead of pinned SHA. Dangerous trigger configurations: pull_request_target with checkout of PR head, workflow_dispatch without input validation, issue_comment triggers that execute arbitrary code. Expression injection via ${{ github.event.*.body }} or similar unsanitized context interpolation in run: steps. Third-party actions from unverified publishers or with low adoption. Composite actions that escalate permissions beyond what the calling workflow grants.

2. OIDC trust scoping and identity federation. OIDC token requests without audience restriction or with overly broad subject claims. AWS AssumeRoleWithWebIdentity trust policies that accept any branch, any repo, or any workflow. Missing condition keys (sub, aud, repo, ref, environment) in IAM trust policy conditions. Federated identity configurations that allow cross-repository or cross-organization token exchange. OIDC tokens requested in workflows that do not need cloud access.

3. Secret injection hygiene. Secrets passed as environment variables to steps that do not need them. Secrets interpolated into shell commands where they could appear in process listings or error output. Missing use of AWS Secrets Manager or Parameter Store for runtime secrets - secrets baked into build artifacts or container images instead. Secrets accessible to pull request workflows from forks. Secret rotation not enforced or documented. Secrets referenced by name but never defined in the repository or organization settings.

4. Deployment artifact integrity and reproducibility. Missing artifact signing (Sigstore, cosign, AWS Signer). No Software Bill of Materials (SBOM) generation for container images or deployment packages. Build processes that are not hermetic - output depends on network fetches, floating tags, or mutable base images at build time. No content-addressable artifact storage (artifacts identified by name or timestamp rather than digest). SLSA provenance not generated or not verified at deployment time. Container images built from :latest or unpinned base images. Lambda deployment packages without integrity verification.

5. Pipeline gating strategies. Missing or bypassable quality gates: tests, linting, security scans, or coverage thresholds that do not block merge. Required status checks not configured as branch protection rules. Manual approval gates missing for production deployments. Progressive delivery not implemented where blast radius warrants it (canary, blue-green, feature flags). Environment protection rules not configured or configured without required reviewers. Deployment pipelines that skip staging or pre-production validation.

6. Rollback automation. No automated rollback mechanism on deployment failure. Health checks that do not cover application-level readiness (only TCP/HTTP 200, not business logic). Missing rollback runbook or rollback procedure not tested. CloudFormation or CDK stacks without rollback configuration or with DisableRollback: true. ECS or Lambda deployments without automatic rollback on alarm. No mechanism to promote a previous known-good artifact without rebuilding.