Securing Continuous Integration and Continuous Delivery (CI/CD) Pipelines: Gates, Pull Request (PR) Guard and Self-Healing Containers

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

Turn your delivery pipeline into an enforced control surface: place Safeguard's checks at the right points from IDE to admission control, wire the CLI into GitHub Actions and GitLab CI with SARIF and JUnit output, and roll out policy gates that block, warn, notify or require approval without stopping the company. You will also learn what PR Guard and self-healing containers add in early access, and how to close the loop with webhooks, tickets and MTTR.

What you'll learn

The Pipeline Attack Surface and Control Points

The CI/CD Attack Surface
Six Control Points and the Safeguard Surface at Each
Choosing a Scan Mode per Stage: Fast, Deep and Proactive

Wiring Safeguard into the Pipeline

GitHub Actions Walkthrough: SBOM, Scan, SARIF and Gate
GitLab CI, Self-Hosted Runners and Other Pipelines
SARIF and JUnit: Making Findings Appear Where Engineers Look
Private Code in CI: Headless Runner, Helm Operator and Results-Only Egress

Gates as Pipeline Control

Gate Anatomy: Policy, Finding, Checkpoint, Action
Designing the Action Ladder and Rolling Gates Out
Gating on Integrity: SCAL, Provenance, Signatures and Admission Control

01The Pipeline Attack Surface and Control Points3 lessons

The CI/CD Attack Surface
Six Control Points and the Safeguard Surface at Each
Choosing a Scan Mode per Stage: Fast, Deep and Proactive

02Wiring Safeguard into the Pipeline4 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

PR Guard [EA]: AI Review Inside the Pull Request

PR Guard [EA]: What It Is and What It Is Not
Operating PR Guard Day to Day

Self-Healing Containers [EA] and Closing the Loop

The Container Leg: Registries, Layers, Drift and Digests
Self-Healing Containers [EA]: Detect, Plan, Rebuild, Promote
Feedback Loops: Webhooks, Chat, Tickets and MTTR

GitHub Actions Walkthrough: SBOM, Scan, SARIF and Gate

GitLab CI, Self-Hosted Runners and Other Pipelines

SARIF and JUnit: Making Findings Appear Where Engineers Look

Private Code in CI: Headless Runner, Helm Operator and Results-Only Egress

03Gates as Pipeline Control3 lessons

Gate Anatomy: Policy, Finding, Checkpoint, Action
Designing the Action Ladder and Rolling Gates Out
Gating on Integrity: SCAL, Provenance, Signatures and Admission Control

04PR Guard [EA]: AI Review Inside the Pull Request2 lessons

PR Guard [EA]: What It Is and What It Is Not
Operating PR Guard Day to Day

05Self-Healing Containers [EA] and Closing the Loop3 lessons

The Container Leg: Registries, Layers, Drift and Digests
Self-Healing Containers [EA]: Detect, Plan, Rebuild, Promote
Feedback Loops: Webhooks, Chat, Tickets and MTTR2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.