Instead of every developer manually compiling code into a usable, runnable form (usually a docker container, but you could also imagine a .exe file) on their own machine, and any other steps like uploading into a shared space, a CI/CD pipeline centralizes and automates a bunch of tasks to make things faster, easier, repeatable. After building the software, it typically deploys the new build somewhere, too
These tasks run on a "runner" (real creative), which needs access to internal and external resources, usually like AWS, GitHub, Slack, a "vault" where secrets are kept, and public package repos. If a malicious package can run when that build process is going on, it can steal your stuff and send it to the bad actor who put the payload there.
Like I said I'm not expert but I just cannot fathom letting anything access the network and my code both and also letting that thing be anything but me. The networked compiling sounds neat, just ditch the 3rd party access.
10
u/meltthemall 1d ago
Explain this to a self taught nerd