The CI/CD supply chain is the linked set of tools, code repositories, build steps, secrets, runners, and automation that turn source code into a deployed application. It includes things like reusable GitHub Actions, package registries, deployment scripts, and the tokens that let workflows access resources.
This matters because every trusted component can become an attack path. If an upstream action, plugin, or build dependency is compromised, malicious code can run inside an automated workflow with the same privileges as the pipeline. Defenders reduce this risk by pinning reusable actions to exact commit SHAs, limiting token permissions, avoiding risky triggers such as pull_request_target for untrusted input, and auditing what each workflow is allowed to do. In practice, CI/CD supply-chain attacks abuse trust in automation rather than breaking the application directly.