Pipeline posture is the overall security state of a continuous integration and continuous delivery (CI/CD) environment. It includes how workflows are triggered and permissioned, how dependencies and third-party actions are managed, how secrets are scoped, and how build runners are isolated and controlled.
It matters because a pipeline executes code and may expose credentials or access connected systems. In an attack, a tampered workflow step or compromised dependency could misuse overly broad permissions or available secrets. Defenders assess pipeline posture by reviewing configuration, limiting each job’s privileges, pinning dependencies to trusted versions, isolating runners, and reducing secrets available at runtime. Posture is a view of the combined controls—not a guarantee that a pipeline is secure or a measure of any single tool.