A CI workflow is an automated continuous integration pipeline that builds, tests, and validates code whenever a commit, pull request, or release event occurs. Many workflows also run code generation, dependency installation, packaging, or publishing steps, so they do more than just compile software.
In cyber security, CI workflows matter because they often hold high-value permissions: repository write access, signing keys, API tokens, and cloud or package-publishing secrets. If an attacker compromises a dependency, a build script, or the workflow definition itself, they may be able to exfiltrate secrets, tamper with generated code, or ship malicious artifacts. Defenders reduce this risk with least privilege, secret scoping, pinned dependencies, locked builds, isolated runners, and mandatory review of generated output and release changes.