Govern reusable pipeline templates and platform trust boundaries
Implementation Effort: High – Requires coordination across platform engineering, security, and development teams. User Impact: Low – Securing shared templates and self-service catalogs is a platform-engineering action; end users are not affected. Lifecycle Stage: Govern
Overview
Establish security governance for reusable platform templates, shared pipeline libraries, and internal developer platform (IDP) self-service catalogs so that every golden path, starter template, and shared workflow enforces the organization's security baseline by default. A security flaw in a shared template propagates instantly across every project that uses it, making platform templates a high-leverage attack surface.
Treat shared pipeline templates and reusable workflows as security-critical infrastructure. Store them in dedicated, access-controlled repositories with branch protection, required code review by security-qualified reviewers, and automated scanning before merge.
Version templates with semantic versioning and immutable releases so consuming teams can pin to a known-good version and adopt updates deliberately. On GitHub, use reusable workflows with the workflow_call trigger and restrict which repositories can call them using access policies. On Azure DevOps, use template references from protected repositories and restrict pipeline permissions so consuming projects cannot override security-critical template steps.
Validate all inputs to reusable workflows and templates. Reusable workflows that accept string inputs without validation are vulnerable to injection attacks. Define input types explicitly, constrain allowed values where possible, and never interpolate input values directly into shell commands.
Re-scan template repositories on a recurring basis. Pin template dependencies and generate SBOMs for templates that include container images, package dependencies, or bundled scripts. Pure Infrastructure as Code templates (Bicep, Terraform) may not require traditional dependency SBOMs unless they reference external modules or container images.
For internal developer platforms and self-service catalogs, enforce that every catalog entry provisions resources with security controls pre-configured: repositories with branch protection enabled, pipelines with secret scanning and SAST active, and cloud resources with managed identity and least-privilege RBAC. Require that self-service provisioning uses approved IaC modules and inherits the organization's policy-as-code baseline. Audit catalog usage to detect provisioning that bypasses the golden path.
Treating shared templates as security-critical infrastructure — with restricted access, mandatory review, input validation, and least-privilege consumption — applies Verify explicitly and Use least privilege access across every project that inherits the golden path.