Categories//view/CI Pipeline from Copilot

CI Pipeline from Copilot

advanced10 min130 pts

Copilot wrote your CI/CD pipeline. It runs tests, builds, and deploys to production. What could go wrong? Everything.

“I got Copilot to generate our entire CI/CD workflow. Tests pass, builds work, deploys succeed. Just need someone to review the YAML before we merge it.”

What you're being evaluated on

Supply chain security - Identify dependency and action pinning risks that enable supply chain attacks.

Injection and code execution - Find where untrusted input can execute arbitrary code in the pipeline.

Deployment safety - Spot missing gates, excessive permissions, and secrets exposure.

3 hints available (using hints reduces your score)

About this scenario

Copilot wrote this CI/CD pipeline: it runs tests, builds containers, and deploys to production. It also checks out untrusted PR code with secret access, evals untrusted PR metadata, pins actions to branches instead of SHAs, and deploys to production with no manual approval. Practice finding supply chain and script injection risks in AI-generated GitHub Actions workflows.

advanced · 130 points · 10 min · AI Code Review

What you will practice

Supply chain security - Identify dependency and action pinning risks that enable supply chain attacks.
Injection and code execution - Find where untrusted input can execute arbitrary code in the pipeline.
Deployment safety - Spot missing gates, excessive permissions, and secrets exposure.

Play the full scenario above for free. More AI Code Review scenarios · Create a free account to save your progress.