Skip to content

How Pipeline Security Works

Pipeline Security connects discovered CI/CD inventory to activity observed by the Runtime Sensor.

Protection Flow

  1. Team Server discovers a pipeline through its provider integration.
  2. The build calls endura job start on a Sensor-enabled host.
  3. The Sensor detects the provider and requests the matching pipeline’s assigned policy.
  4. It evaluates build activity and submits status and violations.
  5. Unconditional cleanup stops the job or its ephemeral Sensor.

Discovery and Runtime Detection

Discovery creates inventory for policy assignment, access control, dashboards, and violation association. Runtime detection reads provider environment variables at job start and enables provider-aware cancellation handling.

A managed build requires an exact pipeline match on vendor, normalized name, path, and provider identifier. A heartbeat can create a missing build under an existing pipeline, but cannot create the pipeline.

The capability matrix lists supported combinations. AWS CodeBuild, Azure Pipelines, and CircleCI have runtime detection only: without an exact existing pipeline, they use local policies and Team Server does not save their build records or violations. Koji has discovery only, so its builds remain unobserved.

Policy Selection

A returned Team Server policy replaces local rules and mode. Otherwise, the job uses its local selection, defaulting to an empty derive policy. See selection and fallback rules.

For pre-checkout enforcement, supply a reviewed external policy with an absolute --policy path. A repository policy may be absent or left over from a previous checkout.

Pipeline and Policy Boundaries

The provider mapping defines which builds share one policy. Derive across every workflow, job type, branch, and optional path inside that boundary.

Protection and Violations

Protection status combines observation with current policy assignment. It does not establish policy mode, uninterrupted coverage, or whether violations were blocked. Inspect Violations for individual outcomes.

Protect Builds