CI/CD pipeline configurations

Identifies CI/CD pipeline configuration files (GitHub Actions workflows, GitLab CI, Azure Pipelines, Jenkinsfiles, Bitbucket/CodeBuild/CircleCI configs) containing pipeline syntax, secret references or internal build/registry hosts. Pipeline topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: topic wording is discovery-only; enforcement requires pipeline syntax, secret references or internal hosts, and 85 adds a second structure and deployment target.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:\.gitlab-ci\.ya?ml|\.github/workflows/[\w.-]{1,80}\.ya?ml|\bazure-pipelines\.ya?ml|\bbitbucket-pipelines\.yml|\bJenkinsfile\b|\bbuildspec\.ya?ml|\.circleci/config\.yml|\b(?:CI/CD|build|release|deployment)\s+pipeline\s+(?:configuration|definition|file|YAML)\b|\bpipeline\s+(?:configuration|definition)\b)

Corroborative evidence keywords

production, docker push, helm upgrade, kubectl apply, terraform apply

Proximity: 300 characters

Should match

.github/workflows/deploy.yml on: workflow_dispatch: jobs: deploy: runs-on: [self-hosted, build01] steps: - uses: actions/checkout@v4 - run: docker push registry.example.internal/payments/api:2.14.0 env: REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} - run: helm upgrade payments ./chart --namespace production — High tier (85) - workflow syntax, secret reference and internal registry host with docker push/helm upgrade to production
Jenkinsfile for the billing service: pipeline { agent any stages { stage('Build') { steps { sh 'mvn -B package' } } } } — Medium tier (75) - Jenkins pipeline syntax only
azure-pipelines.yml excerpt: pool vmImage: ubuntu-latest, then the unit test job. — Medium tier (75) - Azure Pipelines syntax only
The team is rewriting the build pipeline configuration for the mobile app next sprint. — Discovery tier (65) - topic wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
OWASP guidance note: organisations should never store credentials in a CI/CD pipeline configuration; use the platform secret store. — Guidance text
Pipeline configuration blank template runs-on: ________ uses: ________ — Blank template
Training course lab: copy this .gitlab-ci.yml into your sandbox project; it has a stages: list with build and test. — Training framing with pipeline syntax must not enforce

Known false positives

CI/CD documentation, vendor tutorials and security guidance quote pipeline syntax and secret-reference examples. Mitigation: Topic wording is discovery-only; enforcement needs pipeline syntax, secret references or internal hosts, and guidance/tutorial/template framing is excluded.
Secret references (${{ secrets.X }}) name a secret without containing its value. Mitigation: The classifier targets pipeline configuration exposure; actual secret values are handled by the credential classifiers.