build-yaml-misconfiguration

# Build YAML Misconfiguration Detect and prevent security misconfigurations in GitLab CI and Tekton pipeline definitions. Misconfigured build YAML is a common source of secret leakage, privilege escalation, and supply chain compromise. ## GitLab CI (.gitlab-ci.yml) ### Secret Exposure - **Never hardcode secrets** in `.gitlab-ci.yml`, `variables:`, or `script:` blocks. Use CI/CD protected variables or an external vault. - **Mask and protect variables**: set `masked: true` and `protected: true` on sensitive CI/CD variables. Masked variables are redacted from job logs. - **Never echo secrets**: avoid `echo $SECRET`, `printenv`, `env`, or `set -x` in scripts that handle credentials. Debug output is stored in job logs. - **Restrict variable scope**: use `protected: true` to limit variables to protected branches/tags only. Use environment scoping to restrict which jobs see which secrets. - **Artifacts and caches**: never include files containing secrets (`.env`, credentials, tokens) in `artifacts:` or `cache:` paths. These are stored and downloadable. ```yaml # BAD -- secret visible in logs and available on all branches variables: DB_PASSWORD: "hunter2" # GOOD -- use CI/CD protected variable (set in GitLab UI) # Reference as $DB_PASSWORD in scripts; set masked + protected in settings ``` ### Runner and Execution Isolation - **Never use shared runners for secret-heavy jobs** without understanding the trust boundary. Prefer project-specific or group runners for sensitive pi...