{"id":782,"date":"2026-03-25T09:28:53","date_gmt":"2026-03-25T08:28:53","guid":{"rendered":"https:\/\/secure-pipelines.com\/ci-cd-security\/ci-cd-execution-models-trust-assumptions-security-guide-2\/"},"modified":"2026-03-25T09:28:53","modified_gmt":"2026-03-25T08:28:53","slug":"ci-cd-execution-models-trust-assumptions-security-guide-2","status":"publish","type":"post","link":"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/ci-cd-execution-models-trust-assumptions-security-guide-2\/","title":{"rendered":"\u0646\u0645\u0627\u0630\u062c \u062a\u0646\u0641\u064a\u0630 CI\/CD \u0648\u0627\u0641\u062a\u0631\u0627\u0636\u0627\u062a \u0627\u0644\u062b\u0642\u0629: \u062f\u0644\u064a\u0644 \u0623\u0645\u0646\u064a"},"content":{"rendered":"<h2>\u0645\u0642\u062f\u0645\u0629<\/h2>\n<p>\u062a\u064f\u0639\u062f\u0651 \u0623\u0646\u0627\u0628\u064a\u0628 CI\/CD \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u0645\u0643\u0648\u0646\u0627\u062a \u0627\u0645\u062a\u064a\u0627\u0632\u0627\u064b \u0641\u064a \u0623\u064a \u0645\u0624\u0633\u0633\u0629 \u0628\u0631\u0645\u062c\u064a\u0629 \u062d\u062f\u064a\u062b\u0629. \u0641\u0647\u064a \u062a\u0633\u062a\u0646\u0633\u062e \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629\u060c \u0648\u062a\u0635\u0644 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0648\u062a\u0628\u0646\u064a \u0627\u0644\u062d\u0632\u0645 \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0629\u060c \u0648\u062a\u0646\u0634\u0631\u0647\u0627 \u0641\u064a \u0628\u064a\u0626\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u2014 \u0648\u063a\u0627\u0644\u0628\u0627\u064b \u0628\u0623\u062f\u0646\u0649 \u062d\u062f \u0645\u0646 \u0627\u0644\u0625\u0634\u0631\u0627\u0641 \u0627\u0644\u0628\u0634\u0631\u064a. \u0648\u0645\u0639 \u0630\u0644\u0643\u060c \u0648\u0639\u0644\u0649 \u0627\u0644\u0631\u063a\u0645 \u0645\u0646 \u0647\u0630\u0627 \u0627\u0644\u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0627\u0633\u062a\u062b\u0646\u0627\u0626\u064a \u0645\u0646 \u0627\u0644\u0648\u0635\u0648\u0644\u060c \u0646\u0627\u062f\u0631\u0627\u064b \u0645\u0627 \u062a\u064f\u062d\u062f\u064e\u0651\u062f \u0646\u0645\u0627\u0630\u062c \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u062a\u064a \u062a\u0642\u0648\u0645 \u0639\u0644\u064a\u0647\u0627 \u0647\u0630\u0647 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0628\u0634\u0643\u0644 \u0635\u0631\u064a\u062d.<\/p>\n<p>\u0639\u0646\u062f\u0645\u0627 \u062a\u0639\u0645\u0644 \u0623\u0646\u0628\u0648\u0628\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0645\u0627\u060c \u0641\u0625\u0646\u0647\u0627 \u062a\u062c\u064a\u0628 \u0636\u0645\u0646\u064a\u0627\u064b \u0639\u0646 \u0633\u0644\u0633\u0644\u0629 \u0645\u0646 \u0627\u0644\u0623\u0633\u0626\u0644\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629: \u0645\u0646 \u0627\u0644\u0630\u064a \u0623\u0637\u0644\u0642 \u0647\u0630\u0627 \u0627\u0644\u062a\u0646\u0641\u064a\u0630\u061f \u0645\u0627 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062a\u064a \u064a\u062a\u0645 \u062a\u0634\u063a\u064a\u0644\u0647\u0627\u061f \u0645\u0627 \u0627\u0644\u0647\u0648\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u062a\u0628\u0646\u0627\u0647\u0627 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u061f \u0645\u0627 \u0627\u0644\u0645\u0648\u0627\u0631\u062f \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646\u0647\u0627 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647\u0627\u061f \u0641\u064a \u0645\u0639\u0638\u0645 \u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062a\u060c \u062a\u062a\u0645 \u0627\u0644\u0625\u062c\u0627\u0628\u0629 \u0639\u0646 \u0647\u0630\u0647 \u0627\u0644\u0623\u0633\u0626\u0644\u0629 \u0645\u0646 \u062e\u0644\u0627\u0644 \u0627\u0644\u0625\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0642\u0631\u0627\u0631\u0627\u062a \u0623\u0645\u0646\u064a\u0629 \u0645\u062f\u0631\u0648\u0633\u0629.<\/p>\n<p>\u064a\u0631\u0633\u0645 \u0647\u0630\u0627 \u0627\u0644\u062f\u0644\u064a\u0644 \u062e\u0631\u064a\u0637\u0629 \u0644\u0643\u064a\u0641\u064a\u0629 \u0639\u0645\u0644 \u0646\u0645\u0627\u0630\u062c \u062a\u0646\u0641\u064a\u0630 CI\/CD \u0627\u0644\u0645\u062e\u062a\u0644\u0641\u0629\u060c \u0648\u0623\u064a\u0646 \u062a\u064f\u0641\u062a\u0631\u0636 \u0627\u0644\u062b\u0642\u0629 \u0645\u0642\u0627\u0628\u0644 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646\u0647\u0627\u060c \u0648\u0643\u064a\u0641\u064a\u0629 \u062a\u0642\u0648\u064a\u0629 \u0623\u0646\u0627\u0628\u064a\u0628\u0643 \u0636\u062f \u0623\u0646\u0645\u0627\u0637 \u0627\u0644\u0647\u062c\u0648\u0645 \u0627\u0644\u0648\u0627\u0642\u0639\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u0633\u062a\u063a\u0644 \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0627\u062a. \u0633\u0648\u0627\u0621 \u0643\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 GitHub Actions \u0623\u0648 GitLab CI \u0623\u0648 \u0645\u0646\u0635\u0629 \u0623\u062e\u0631\u0649\u060c \u0641\u0625\u0646 \u062f\u064a\u0646\u0627\u0645\u064a\u0643\u064a\u0627\u062a \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629 \u0639\u0627\u0644\u0645\u064a\u0629 \u2014 \u0648\u0641\u0647\u0645\u0647\u0627 \u0636\u0631\u0648\u0631\u064a \u0644\u062a\u0623\u0645\u064a\u0646 \u0633\u0644\u0633\u0644\u0629 \u062a\u0648\u0631\u064a\u062f \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0643.<\/p>\n<h2>\u0645\u0627 \u0647\u0648 \u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 CI\/CD\u061f<\/h2>\n<p>\u064a\u064f\u062d\u062f\u062f \u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 CI\/CD \u062f\u0648\u0631\u0629 \u0627\u0644\u062d\u064a\u0627\u0629 \u0627\u0644\u0643\u0627\u0645\u0644\u0629 \u0644\u0643\u064a\u0641\u064a\u0629 \u062a\u0634\u063a\u064a\u0644 \u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u060c \u0648\u0627\u0644\u0645\u0643\u0627\u0646 \u0627\u0644\u0630\u064a \u062a\u0639\u0645\u0644 \u0641\u064a\u0647 \u0641\u0639\u0644\u064a\u0627\u064b\u060c \u0648\u0627\u0644\u0647\u0648\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u062a\u0628\u0646\u0627\u0647\u0627 \u0623\u062b\u0646\u0627\u0621 \u0627\u0644\u062a\u0646\u0641\u064a\u0630\u060c \u0648\u0627\u0644\u0645\u0648\u0627\u0631\u062f \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646\u0647\u0627 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647\u0627. \u0625\u0646\u0647 \u0641\u064a \u062c\u0648\u0647\u0631\u0647 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0644\u0637\u0628\u0642\u0629 \u0627\u0644\u0623\u062a\u0645\u062a\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0643.<\/p>\n<p>\u064a\u062c\u0628 \u0639\u0644\u0649 \u0643\u0644 \u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 \u0623\u0646 \u064a\u062c\u064a\u0628 \u0639\u0646 \u0623\u0631\u0628\u0639\u0629 \u0623\u0633\u0626\u0644\u0629 \u062c\u0648\u0647\u0631\u064a\u0629:<\/p>\n<ul>\n<li><strong>\u0627\u0644\u0645\u064f\u062d\u0641\u0650\u0651\u0632 (Trigger):<\/strong> \u0645\u0627 \u0627\u0644\u062d\u062f\u062b \u0627\u0644\u0630\u064a \u064a\u0628\u062f\u0623 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u060c \u0648\u0645\u0646 \u0623\u0648 \u0645\u0627 \u0627\u0644\u0645\u064f\u062e\u0648\u064e\u0651\u0644 \u0628\u0625\u062d\u062f\u0627\u062b \u0630\u0644\u0643 \u0627\u0644\u062d\u062f\u062b\u061f<\/li>\n<li><strong>\u0627\u0644\u0628\u064a\u0626\u0629 (Environment):<\/strong> \u0623\u064a\u0646 \u062a\u064f\u0646\u0641\u064e\u0651\u0630 \u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u2014 \u0639\u0644\u0649 \u0623\u064a \u0628\u0646\u064a\u0629 \u062a\u062d\u062a\u064a\u0629\u060c \u0648\u0628\u0623\u064a \u0646\u0638\u0627\u0645 \u062a\u0634\u063a\u064a\u0644\u060c \u0648\u0628\u0623\u064a \u062f\u0631\u062c\u0629 \u0645\u0646 \u0627\u0644\u0639\u0632\u0644\u061f<\/li>\n<li><strong>\u0627\u0644\u0647\u0648\u064a\u0629 (Identity):<\/strong> \u0645\u0627 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0623\u0648 \u0627\u0644\u0631\u0645\u0648\u0632 \u0627\u0644\u0645\u0645\u064a\u0632\u0629 \u0623\u0648 \u062d\u0633\u0627\u0628\u0627\u062a \u0627\u0644\u062e\u062f\u0645\u0629 \u0627\u0644\u062a\u064a \u062a\u0645\u062a\u0644\u0643\u0647\u0627 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0623\u062b\u0646\u0627\u0621 \u0627\u0644\u062a\u0634\u063a\u064a\u0644\u061f<\/li>\n<li><strong>\u0627\u0644\u0648\u0635\u0648\u0644 (Access):<\/strong> \u0645\u0627 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0627\u0644\u0646\u0647\u0627\u0626\u064a\u0629 \u0648\u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0648\u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0648\u0623\u0647\u062f\u0627\u0641 \u0627\u0644\u0646\u0634\u0631 \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646 \u0644\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647\u0627\u061f<\/li>\n<\/ul>\n<p>\u062a\u062e\u062a\u0644\u0641 \u0637\u0631\u064a\u0642\u0629 \u0627\u0644\u0625\u062c\u0627\u0628\u0629 \u0639\u0646 \u0647\u0630\u0647 \u0627\u0644\u0623\u0633\u0626\u0644\u0629 \u0627\u062e\u062a\u0644\u0627\u0641\u0627\u064b \u0643\u0628\u064a\u0631\u0627\u064b \u0639\u0628\u0631 \u0628\u064a\u0626\u0627\u062a \u0627\u0644\u062a\u0646\u0641\u064a\u0630:<\/p>\n<h3>\u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u0636\u0627\u0641\u0629 \u0639\u0628\u0631 SaaS<\/h3>\n<p>\u062a\u0648\u0641\u0631 \u0645\u0646\u0635\u0627\u062a \u0645\u062b\u0644 GitHub Actions (\u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0646 GitHub) \u0648GitLab.com shared runners \u0622\u0644\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0645\u0624\u0642\u062a\u0629 \u062a\u064f\u062f\u0627\u0631 \u0628\u0648\u0627\u0633\u0637\u0629 \u0645\u0632\u0648\u0651\u062f CI\/CD. \u0639\u0627\u062f\u0629\u064b \u0645\u0627 \u064a\u062d\u0635\u0644 \u0643\u0644 \u0645\u0647\u0645\u0629 \u0639\u0644\u0649 \u0622\u0644\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u062c\u062f\u064a\u062f\u0629 \u062a\u064f\u062f\u0645\u064e\u0651\u0631 \u0628\u0639\u062f \u0627\u0644\u062a\u0646\u0641\u064a\u0630. \u062a\u062a\u0648\u0644\u0649 \u0627\u0644\u0645\u0646\u0635\u0629 \u0625\u062f\u0627\u0631\u0629 \u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0648\u0627\u0644\u0639\u0632\u0644 \u0648\u062f\u0648\u0631\u0629 \u0627\u0644\u062d\u064a\u0627\u0629. \u0627\u0644\u0645\u0642\u0627\u064a\u0636\u0629 \u0647\u0646\u0627 \u0647\u064a \u0623\u0646\u0643 \u062a\u062b\u0642 \u0628\u0636\u0645\u0627\u0646\u0627\u062a \u0627\u0644\u0639\u0632\u0644 \u0627\u0644\u062a\u064a \u064a\u0642\u062f\u0645\u0647\u0627 \u0627\u0644\u0645\u0632\u0648\u0651\u062f \u2014 \u0641\u0644\u0627 \u064a\u0645\u0643\u0646\u0643 \u0641\u062d\u0635 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629 \u0623\u0648 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a\u0647\u0627.<\/p>\n<h3>\u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 (Self-Hosted Runners)<\/h3>\n<p>\u062a\u0646\u0634\u0631 \u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062a \u0648\u0643\u0644\u0627\u0621 \u0627\u0644\u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0647\u0627 \u0639\u0644\u0649 \u0628\u0646\u064a\u0629 \u062a\u062d\u062a\u064a\u0629 \u062a\u062a\u062d\u0643\u0645 \u0641\u064a\u0647\u0627 \u2014 \u0622\u0644\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0623\u0648 \u062e\u0648\u0627\u062f\u0645 \u0645\u0627\u062f\u064a\u0629 \u0623\u0648 pods \u0641\u064a Kubernetes. \u064a\u0645\u0646\u062d \u0647\u0630\u0627 \u062a\u062d\u0643\u0645\u0627\u064b \u0643\u0627\u0645\u0644\u0627\u064b \u0641\u064a \u0628\u064a\u0626\u0629 \u0627\u0644\u062a\u0646\u0641\u064a\u0630\u060c \u0644\u0643\u0646\u0647 \u064a\u0646\u0642\u0644 \u0645\u0633\u0624\u0648\u0644\u064a\u0629 \u0627\u0644\u0639\u0632\u0644 \u0648\u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0648\u0625\u062f\u0627\u0631\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0628\u0627\u0644\u0643\u0627\u0645\u0644 \u0625\u0644\u0649 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644. \u064a\u064f\u0639\u062f\u0651 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0630\u0627\u062a\u064a \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0627\u0644\u0645\u064f\u0647\u064a\u064e\u0651\u0623 \u0628\u0634\u0643\u0644 \u062e\u0627\u0637\u0626 \u0645\u0646 \u0623\u0643\u062b\u0631 \u0646\u0648\u0627\u0642\u0644 \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u062c\u0627\u0646\u0628\u064a\u0629 \u0634\u064a\u0648\u0639\u0627\u064b \u0641\u064a \u0647\u062c\u0645\u0627\u062a CI\/CD.<\/p>\n<h3>\u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0641\u064a \u062d\u0627\u0648\u064a\u0627\u062a (Containerized Execution)<\/h3>\n<p>\u062a\u064f\u0634\u063a\u0651\u0644 \u0627\u0644\u0639\u062f\u064a\u062f \u0645\u0646 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u0645\u0647\u0627\u0645 \u062f\u0627\u062e\u0644 \u062d\u0627\u0648\u064a\u0627\u062a\u060c \u0633\u0648\u0627\u0621 \u0639\u0644\u0649 \u0628\u0646\u064a\u0629 \u062a\u062d\u062a\u064a\u0629 \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0623\u0648 \u0639\u0644\u0649 \u0645\u062c\u0645\u0648\u0639\u0627\u062a Kubernetes \u0645\u064f\u062f\u0627\u0631\u0629. \u064a\u0648\u0641\u0631 \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0642\u0627\u0626\u0645 \u0639\u0644\u0649 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a \u0639\u0632\u0644\u0627\u064b \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0648\u0628\u064a\u0626\u0627\u062a \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u0643\u0631\u0627\u0631\u060c \u0644\u0643\u0646 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a \u0644\u064a\u0633\u062a \u062d\u062f\u0648\u062f\u0627\u064b \u0623\u0645\u0646\u064a\u0629 \u0628\u0646\u0641\u0633 \u0627\u0644\u0637\u0631\u064a\u0642\u0629 \u0627\u0644\u062a\u064a \u062a\u0643\u0648\u0646 \u0628\u0647\u0627 \u0627\u0644\u0622\u0644\u0627\u062a \u0627\u0644\u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629. \u064a\u0645\u0643\u0646 \u0623\u0646 \u064a\u064f\u0642\u0648\u0651\u0636 \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0645\u0634\u062a\u0631\u0643 \u0625\u0644\u0649 \u0627\u0644\u0646\u0648\u0627\u0629 \u0648\u0627\u0644\u0623\u0642\u0631\u0627\u0635 \u0627\u0644\u0645\u064f\u0631\u0643\u064e\u0651\u0628\u0629 \u0648\u0643\u0634\u0641 Docker socket \u0646\u0645\u0648\u0630\u062c \u0627\u0644\u0639\u0632\u0644.<\/p>\n<h3>\u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0628\u062f\u0648\u0646 \u062e\u0627\u062f\u0645 \u0648\u0639\u0646\u062f \u0627\u0644\u0637\u0644\u0628 (Serverless and On-Demand Execution)<\/h3>\n<p>\u062a\u064f\u0646\u0634\u0626 \u0628\u0639\u0636 \u0623\u0646\u0638\u0645\u0629 CI\/CD \u0627\u0644\u062d\u062f\u064a\u062b\u0629 (\u0645\u062b\u0644 AWS CodeBuild \u0623\u0648 \u0628\u0639\u0636 \u062a\u0643\u0648\u064a\u0646\u0627\u062a Buildkite) \u0645\u0648\u0627\u0631\u062f \u062d\u0648\u0633\u0628\u0629 \u0639\u0646\u062f \u0627\u0644\u0637\u0644\u0628 \u0644\u0643\u0644 \u0645\u0647\u0645\u0629. \u062a\u0642\u062f\u0645 \u0647\u0630\u0647 \u0627\u0644\u0646\u0645\u0627\u0630\u062c \u0636\u0645\u0627\u0646\u0627\u062a \u0639\u0632\u0644 \u0642\u0648\u064a\u0629 \u062d\u064a\u062b \u064a\u062d\u0635\u0644 \u0643\u0644 \u062a\u0646\u0641\u064a\u0630 \u0639\u0644\u0649 \u0645\u062b\u064a\u0644 \u062d\u0648\u0633\u0628\u0629 \u0645\u062e\u0635\u0635 \u0642\u0635\u064a\u0631 \u0627\u0644\u0639\u0645\u0631\u060c \u0644\u0643\u0646\u0647\u0627 \u062a\u064f\u062f\u062e\u0644 \u062a\u0639\u0642\u064a\u062f\u0627\u064b \u062d\u0648\u0644 \u062a\u0647\u064a\u0626\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0648\u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629.<\/p>\n<p>\u0625\u0646 \u0641\u0647\u0645 \u0627\u0644\u0646\u0645\u0648\u0630\u062c \u0627\u0644\u0630\u064a \u062a\u0633\u062a\u062e\u062f\u0645\u0647 \u0645\u0624\u0633\u0633\u062a\u0643 \u2014 \u0648\u0627\u0644\u062e\u0635\u0627\u0626\u0635 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u062a\u064a \u064a\u0648\u0641\u0631\u0647\u0627 \u0648\u0627\u0644\u062a\u064a \u0644\u0627 \u064a\u0648\u0641\u0631\u0647\u0627 \u2014 \u0647\u0648 \u0627\u0644\u0623\u0633\u0627\u0633 \u0644\u0644\u062a\u0641\u0643\u064a\u0631 \u0641\u064a \u062b\u0642\u0629 CI\/CD.<\/p>\n<h2>\u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629 \u0641\u064a CI\/CD<\/h2>\n<p>\u064a\u0648\u062c\u062f \u062d\u062f \u062b\u0642\u0629 \u062d\u064a\u062b\u0645\u0627 \u064a\u0646\u062a\u0642\u0644 \u0627\u0644\u062a\u062d\u0643\u0645 \u0645\u0646 \u0643\u064a\u0627\u0646 \u0623\u0648 \u0646\u0638\u0627\u0645 \u0625\u0644\u0649 \u0622\u062e\u0631. \u0641\u064a CI\/CD\u060c \u0647\u0646\u0627\u0643 \u0639\u062f\u0629 \u062d\u062f\u0648\u062f \u062b\u0642\u0629 \u062d\u0631\u062c\u0629\u060c \u0648\u0627\u0644\u0625\u062e\u0641\u0627\u0642 \u0639\u0646\u062f \u0623\u064a \u0645\u0646\u0647\u0627 \u064a\u0645\u0643\u0646 \u0623\u0646 \u064a\u0624\u062f\u064a \u0625\u0644\u0649 \u0627\u062e\u062a\u0631\u0627\u0642 \u0643\u0627\u0645\u0644 \u0644\u0644\u0623\u0646\u0628\u0648\u0628\u0629.<\/p>\n<h3>\u0645\u0646 \u0645\u0633\u062a\u0648\u062f\u0639 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0625\u0644\u0649 \u0645\u064f\u062d\u0641\u0650\u0651\u0632 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629<\/h3>\n<p>\u062d\u062f \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u0623\u0648\u0644 \u064a\u0642\u0639 \u0628\u064a\u0646 \u0645\u0633\u062a\u0648\u062f\u0639 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0648\u0645\u064f\u062d\u0641\u0650\u0651\u0632 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629. \u0639\u0646\u062f\u0645\u0627 \u064a\u062f\u0641\u0639 \u0645\u0637\u0648\u0651\u0631 \u0627\u0644\u062a\u0632\u0627\u0645\u0627\u064b \u0623\u0648 \u064a\u0641\u062a\u062d \u0637\u0644\u0628 \u0633\u062d\u0628 (pull request)\u060c \u062a\u0642\u0631\u0631 \u0645\u0646\u0635\u0629 CI\/CD \u0645\u0627 \u0625\u0630\u0627 \u0643\u0627\u0646\u062a \u0633\u062a\u0646\u0641\u0630 \u0623\u0646\u0628\u0648\u0628\u0629 \u0648\u0643\u064a\u0641. \u0627\u0644\u0633\u0624\u0627\u0644 \u0627\u0644\u062d\u0631\u062c \u0647\u0648: <strong>\u0645\u0646 \u064a\u0645\u0643\u0646\u0647 \u062a\u0634\u063a\u064a\u0644 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u060c \u0648\u0647\u0644 \u064a\u0645\u0643\u0646\u0647 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062a\u064a \u062a\u064f\u0634\u063a\u0651\u0644\u0647\u0627 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u061f<\/strong><\/p>\n<p>\u0641\u064a \u0643\u062b\u064a\u0631 \u0645\u0646 \u0627\u0644\u062a\u0643\u0648\u064a\u0646\u0627\u062a\u060c \u064a\u0645\u0643\u0646 \u0644\u0623\u064a \u0634\u062e\u0635 \u064a\u0633\u062a\u0637\u064a\u0639 \u0641\u062a\u062d \u0637\u0644\u0628 \u0633\u062d\u0628 \u2014 \u0628\u0645\u0627 \u0641\u064a \u0630\u0644\u0643 \u0627\u0644\u0645\u0633\u0627\u0647\u0645\u0648\u0646 \u0627\u0644\u062e\u0627\u0631\u062c\u064a\u0648\u0646 \u0641\u064a \u0627\u0644\u0645\u0633\u062a\u0648\u062f\u0639\u0627\u062a \u0627\u0644\u0639\u0627\u0645\u0629 \u2014 \u062a\u0634\u063a\u064a\u0644 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629. \u0625\u0630\u0627 \u0643\u0627\u0646 \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0646\u0641\u0633\u0647 \u064a\u0623\u062a\u064a \u0645\u0646 \u0641\u0631\u0639 \u0637\u0644\u0628 \u0627\u0644\u0633\u062d\u0628\u060c \u0641\u0625\u0646 \u0627\u0644\u0645\u0633\u0627\u0647\u0645 \u064a\u062a\u062d\u0643\u0645 \u0641\u0639\u0644\u064a\u0627\u064b \u0641\u064a \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062a\u064a \u062a\u0639\u0645\u0644 \u0641\u064a \u0628\u064a\u0626\u0629 CI \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0643.<\/p>\n<h3>\u0645\u0646 \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0625\u0644\u0649 \u0628\u064a\u0626\u0629 \u0627\u0644\u062a\u0646\u0641\u064a\u0630<\/h3>\n<p>\u062d\u062f \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u062b\u0627\u0646\u064a \u064a\u0641\u0635\u0644 \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 (\u0645\u0644\u0641 YAML \u0623\u0648 Jenkinsfile \u0623\u0648 \u0633\u0643\u0631\u064a\u0628\u062a \u0627\u0644\u0628\u0646\u0627\u0621) \u0639\u0646 \u0627\u0644\u0628\u064a\u0626\u0629 \u0627\u0644\u062a\u064a \u064a\u064f\u0646\u0641\u064e\u0651\u0630 \u0641\u064a\u0647\u0627. \u062a\u0634\u0645\u0644 \u0627\u0644\u0623\u0633\u0626\u0644\u0629 \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629: \u0647\u0644 \u064a\u0645\u0644\u0643 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629\u061f \u0647\u0644 \u064a\u0645\u0643\u0646 \u0644\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u062a\u062b\u0628\u064a\u062a \u0628\u0631\u0627\u0645\u062c \u0639\u0634\u0648\u0627\u0626\u064a\u0629\u061f \u0647\u0644 \u064a\u0645\u0643\u0646\u0647\u0627 \u062a\u0639\u062f\u064a\u0644 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0646\u0641\u0633\u0647 \u0644\u0644\u0645\u0647\u0627\u0645 \u0627\u0644\u0645\u0633\u062a\u0642\u0628\u0644\u064a\u0629\u061f<\/p>\n<p>\u0639\u0644\u0649 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0634\u062a\u0631\u0643\u0629 \u0623\u0648 \u0627\u0644\u0645\u0633\u062a\u0645\u0631\u0629\u060c \u064a\u0645\u0643\u0646 \u0644\u062a\u0639\u0631\u064a\u0641 \u0623\u0646\u0628\u0648\u0628\u0629 \u062e\u0628\u064a\u062b \u062a\u062b\u0628\u064a\u062a \u0628\u0627\u0628 \u062e\u0644\u0641\u064a \u064a\u0633\u062a\u0645\u0631 \u0639\u0628\u0631 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0644\u0627\u062d\u0642\u0629 \u2014 \u0645\u0645\u0627 \u064a\u0624\u062b\u0631 \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u062f\u0639\u0627\u062a \u0648\u0641\u0631\u0642 \u0645\u062e\u062a\u0644\u0641\u0629 \u062a\u0645\u0627\u0645\u0627\u064b.<\/p>\n<h3>\u0645\u0646 \u0628\u064a\u0626\u0629 \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0648\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f<\/h3>\n<p>\u062a\u062d\u062a\u0627\u062c \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0625\u0644\u0649 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0644\u0644\u0642\u064a\u0627\u0645 \u0628\u0639\u0645\u0644 \u0645\u0641\u064a\u062f: \u0631\u0645\u0648\u0632 API \u0648\u0645\u0641\u0627\u062a\u064a\u062d \u0645\u0632\u0648\u062f\u064a \u0627\u0644\u0633\u062d\u0627\u0628\u0629 \u0648\u0643\u0644\u0645\u0627\u062a \u0645\u0631\u0648\u0631 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0648\u0645\u0641\u0627\u062a\u064a\u062d \u0627\u0644\u062a\u0648\u0642\u064a\u0639. \u064a\u062d\u062f\u062f \u062d\u062f \u0627\u0644\u062b\u0642\u0629 \u0628\u064a\u0646 \u0628\u064a\u0626\u0629 \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0648\u0645\u062e\u0632\u0646 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0645\u0627 \u064a\u0645\u0643\u0646 \u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0645\u062e\u062a\u0631\u0642\u0629 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647. \u064a\u064f\u0639\u062f\u0651 \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0645\u0641\u0631\u0637 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u0623\u062e\u0637\u0627\u0621 \u0634\u064a\u0648\u0639\u0627\u064b \u0648\u062e\u0637\u0648\u0631\u0629 \u0641\u064a \u062a\u0643\u0648\u064a\u0646\u0627\u062a CI\/CD.<\/p>\n<h3>\u0645\u0646 \u0645\u062e\u0631\u062c\u0627\u062a \u0627\u0644\u0628\u0646\u0627\u0621 \u0625\u0644\u0649 \u0647\u062f\u0641 \u0627\u0644\u0646\u0634\u0631<\/h3>\n<p>\u062d\u062f \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u0623\u062e\u064a\u0631 \u064a\u0642\u0639 \u0628\u064a\u0646 \u0645\u0627 \u062a\u0646\u062a\u062c\u0647 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 (\u0635\u0648\u0631\u0629 \u062d\u0627\u0648\u064a\u0629 \u0623\u0648 \u0645\u0644\u0641 \u062b\u0646\u0627\u0626\u064a \u0623\u0648 \u062e\u0637\u0629 Terraform) \u0648\u0627\u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u0630\u064a \u062a\u064f\u0646\u0634\u0631 \u0641\u064a\u0647 \u062a\u0644\u0643 \u0627\u0644\u0645\u062e\u0631\u062c\u0627\u062a. \u0625\u0630\u0627 \u0643\u0627\u0646\u062a \u0647\u0648\u064a\u0629 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u062a\u064a \u062a\u0628\u0646\u064a \u0627\u0644\u062d\u0632\u0645\u0629 \u0647\u064a \u0646\u0641\u0633 \u0627\u0644\u0647\u0648\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u0646\u0634\u0631\u0647\u0627 \u0641\u064a \u0627\u0644\u0625\u0646\u062a\u0627\u062c\u060c \u0641\u0644\u0627 \u064a\u0648\u062c\u062f \u0641\u0635\u0644 \u0641\u064a \u0627\u0644\u0645\u0633\u0624\u0648\u0644\u064a\u0627\u062a. \u064a\u0645\u0643\u0646 \u0623\u0646 \u062a\u0624\u062f\u064a \u062e\u0637\u0648\u0629 \u0628\u0646\u0627\u0621 \u0648\u0627\u062d\u062f\u0629 \u0645\u062e\u062a\u0631\u0642\u0629 \u0645\u0628\u0627\u0634\u0631\u0629 \u0625\u0644\u0649 \u0627\u062e\u062a\u0631\u0627\u0642 \u0628\u064a\u0626\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c.<\/p>\n<h3>\u0631\u0633\u0645 \u062e\u0631\u064a\u0637\u0629 \u0645\u0646\u0627\u0637\u0642 \u0627\u0644\u062b\u0642\u0629<\/h3>\n<p>\u0645\u0646 \u0627\u0644\u0646\u0627\u062d\u064a\u0629 \u0627\u0644\u0645\u0641\u0627\u0647\u064a\u0645\u064a\u0629\u060c \u062a\u0645\u0631 \u0623\u0646\u0628\u0648\u0628\u0629 CI\/CD \u0639\u0628\u0631 \u0623\u0631\u0628\u0639 \u0645\u0646\u0627\u0637\u0642 \u062b\u0642\u0629:<\/p>\n<pre><code>Zone 1: Source Control (Developer workstations, branches, PRs)\n   \u2193 [Trigger boundary]\nZone 2: Pipeline Definition (YAML\/config parsed by CI platform)\n   \u2193 [Execution boundary]\nZone 3: Execution Environment (Runner, container, VM \u2014 with secrets)\n   \u2193 [Deployment boundary]\nZone 4: Deployment Targets (Production, staging, registries, cloud APIs)\n<\/code><\/pre>\n<p>\u064a\u0645\u062b\u0644 \u0643\u0644 \u0633\u0647\u0645 \u062d\u062f \u062b\u0642\u0629. \u064a\u062c\u0628 \u0623\u0646 \u062a\u0648\u062c\u062f \u0636\u0648\u0627\u0628\u0637 \u0623\u0645\u0646\u064a\u0629 \u0639\u0646\u062f \u0643\u0644 \u0627\u0646\u062a\u0642\u0627\u0644: \u0642\u0648\u0627\u0639\u062f \u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0641\u0631\u0648\u0639 \u0639\u0646\u062f \u062d\u062f \u0627\u0644\u0645\u064f\u062d\u0641\u0650\u0651\u0632\u060c \u0648\u0639\u0632\u0644 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0639\u0646\u062f \u062d\u062f \u0627\u0644\u062a\u0646\u0641\u064a\u0630\u060c \u0648\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0645\u062d\u062f\u0648\u062f\u0629 \u0627\u0644\u0646\u0637\u0627\u0642 \u0639\u0646\u062f \u062d\u062f \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0648\u0645\u0648\u0627\u0641\u0642\u0627\u062a \u0627\u0644\u0646\u0634\u0631 \u0639\u0646\u062f \u062d\u062f \u0627\u0644\u0646\u0634\u0631.<\/p>\n<h2>\u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 GitHub Actions<\/h2>\n<p>\u062a\u064f\u0639\u062f\u0651 GitHub Actions \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0623\u0643\u062b\u0631 \u0645\u0646\u0635\u0627\u062a CI\/CD \u0627\u0639\u062a\u0645\u0627\u062f\u0627\u064b\u060c \u0648\u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630\u0647\u0627 \u064a\u062a\u0645\u062a\u0639 \u0628\u0639\u062f\u0629 \u062e\u0635\u0627\u0626\u0635 \u062b\u0642\u0629 \u0641\u0631\u064a\u062f\u0629 \u062a\u0633\u062a\u062d\u0642 \u0627\u0644\u0641\u0647\u0645 \u0627\u0644\u0645\u0639\u0645\u0651\u0642.<\/p>\n<h3>\u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0646 GitHub \u0645\u0642\u0627\u0628\u0644 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629<\/h3>\n<p>\u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0646 GitHub \u0647\u064a \u0622\u0644\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0645\u0624\u0642\u062a\u0629 \u062a\u064f\u0648\u0641\u0651\u0631\u0647\u0627 GitHub \u0644\u0643\u0644 \u0645\u0647\u0645\u0629. \u062a\u0639\u0645\u0644 \u0639\u0644\u0649 \u0628\u0646\u064a\u0629 Azure \u0627\u0644\u062a\u062d\u062a\u064a\u0629\u060c \u0648\u062a\u064f\u062f\u0645\u064e\u0651\u0631 \u0628\u0639\u062f \u0627\u0643\u062a\u0645\u0627\u0644 \u0643\u0644 \u0645\u0647\u0645\u0629\u060c \u0648\u062a\u0648\u0641\u0631 \u0639\u0632\u0644\u0627\u064b \u0642\u0648\u064a\u0627\u064b \u0628\u064a\u0646 \u0627\u0644\u0645\u0647\u0627\u0645. \u0623\u0645\u0627 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0641\u0647\u064a \u0623\u062c\u0647\u0632\u0629 \u062a\u0633\u062c\u0651\u0644\u0647\u0627 \u0644\u062f\u0649 GitHub. \u062a\u0633\u062a\u0645\u0631 \u0628\u064a\u0646 \u0627\u0644\u0645\u0647\u0627\u0645 \u0648\u064a\u0645\u0643\u0646\u0647\u0627 \u062a\u062c\u0645\u064a\u0639 \u062d\u0627\u0644\u0629\u060c \u0648\u0627\u0644\u0623\u0647\u0645 \u0645\u0646 \u0630\u0644\u0643 \u0623\u0646 \u0623\u064a \u0645\u0633\u062a\u0648\u062f\u0639 \u0641\u064a \u0627\u0644\u0645\u0646\u0638\u0645\u0629 \u0644\u062f\u064a\u0647 \u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u064a\u0645\u0643\u0646\u0647 \u062a\u0646\u0641\u064a\u0630 \u0634\u064a\u0641\u0631\u0629 \u0639\u0644\u064a\u0647.<\/p>\n<p>\u0628\u0627\u0644\u0646\u0633\u0628\u0629 \u0644\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629\u060c \u062a\u062d\u0630\u0631 GitHub \u0635\u0631\u0627\u062d\u0629\u064b: <strong>\u0644\u0627 \u062a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0639 \u0627\u0644\u0645\u0633\u062a\u0648\u062f\u0639\u0627\u062a \u0627\u0644\u0639\u0627\u0645\u0629.<\/strong> \u064a\u0645\u0643\u0646 \u0644\u0623\u064a fork \u062a\u0642\u062f\u064a\u0645 \u0637\u0644\u0628 \u0633\u062d\u0628 \u064a\u064f\u0634\u063a\u0651\u0644 \u0633\u064a\u0631 \u0639\u0645\u0644\u060c \u0648\u0647\u0630\u0627 \u0627\u0644\u0633\u064a\u0631 \u064a\u064f\u0646\u0641\u064e\u0651\u0630 \u0639\u0644\u0649 \u0628\u0646\u064a\u062a\u0643 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0645\u0639 \u0648\u0635\u0648\u0644\u0643 \u0644\u0644\u0634\u0628\u0643\u0629.<\/p>\n<h3>\u0623\u0630\u0648\u0646\u0627\u062a \u0648\u0646\u0637\u0627\u0642 GITHUB_TOKEN<\/h3>\n<p>\u064a\u062a\u0644\u0642\u0649 \u0643\u0644 \u062a\u0634\u063a\u064a\u0644 \u0633\u064a\u0631 \u0639\u0645\u0644 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b <code>GITHUB_TOKEN<\/code> \u0628\u0623\u0630\u0648\u0646\u0627\u062a \u0645\u062d\u062f\u062f\u0629 \u0627\u0644\u0646\u0637\u0627\u0642 \u0644\u0644\u0645\u0633\u062a\u0648\u062f\u0639. \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b\u060c \u064a\u0645\u062a\u0644\u0643 \u0647\u0630\u0627 \u0627\u0644\u0631\u0645\u0632 \u0623\u0630\u0648\u0646\u0627\u062a \u0642\u0631\u0627\u0621\u0629\/\u0643\u062a\u0627\u0628\u0629 \u0648\u0627\u0633\u0639\u0629 \u0644\u0645\u062d\u062a\u0648\u064a\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u0648\u062f\u0639 \u0648\u0627\u0644\u062d\u0632\u0645 \u0648\u0627\u0644\u0645\u0634\u0643\u0644\u0627\u062a \u0648\u0623\u0643\u062b\u0631. \u064a\u0633\u0645\u062d \u0645\u0641\u062a\u0627\u062d <code>permissions<\/code> \u0628\u062a\u0642\u064a\u064a\u062f \u0647\u0630\u0627 \u0627\u0644\u0631\u0645\u0632 \u0625\u0644\u0649 \u0645\u0627 \u0647\u0648 \u0645\u0637\u0644\u0648\u0628 \u0641\u0642\u0637:<\/p>\n<pre><code>permissions:\n  contents: read\n  packages: write\n  id-token: write   # For OIDC federation\n<\/code><\/pre>\n<p>\u064a\u064f\u0639\u062f\u0651 \u062a\u0639\u064a\u064a\u0646 \u0627\u0644\u0623\u0630\u0648\u0646\u0627\u062a \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0623\u0639\u0644\u0649 \u0625\u0644\u0649 <code>read-all<\/code> \u0623\u0648 \u062d\u062a\u0649 \u0641\u0627\u0631\u063a\u0629 (<code>{}<\/code>) \u062b\u0645 \u0645\u0646\u062d \u0623\u0630\u0648\u0646\u0627\u062a \u0645\u062d\u062f\u062f\u0629 \u0644\u0643\u0644 \u0645\u0647\u0645\u0629 \u062e\u0637\u0648\u0629 \u062a\u0642\u0648\u064a\u0629 \u062d\u0627\u0633\u0645\u0629. \u0628\u062f\u0648\u0646 \u0630\u0644\u0643\u060c \u0641\u0625\u0646 \u0623\u064a \u062e\u0637\u0648\u0629 \u0645\u062e\u062a\u0631\u0642\u0629 \u0641\u064a \u0623\u064a \u0645\u0647\u0645\u0629 \u062a\u0645\u0644\u0643 \u0648\u0635\u0648\u0644 \u0643\u062a\u0627\u0628\u0629 \u0625\u0644\u0649 \u0645\u0633\u062a\u0648\u062f\u0639\u0643.<\/p>\n<h3>\u0633\u064a\u0631 \u0639\u0645\u0644 Fork PR: pull_request \u0645\u0642\u0627\u0628\u0644 pull_request_target<\/h3>\n<p>\u0647\u0630\u0627 \u0623\u062d\u062f \u0623\u062e\u0637\u0631 \u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629 \u0641\u064a GitHub Actions. \u064a\u064f\u0634\u063a\u0651\u0644 \u062d\u062f\u062b <code>pull_request<\/code> \u062a\u0639\u0631\u064a\u0641 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0645\u0646 \u0641\u0631\u0639 head \u0627\u0644\u062e\u0627\u0635 \u0628\u0637\u0644\u0628 \u0627\u0644\u0633\u062d\u0628 \u2014 \u0645\u0645\u0627 \u064a\u0639\u0646\u064a \u0623\u0646 \u0627\u0644\u0645\u0633\u0627\u0647\u0645 \u064a\u062a\u062d\u0643\u0645 \u0641\u064a \u0634\u064a\u0641\u0631\u0629 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u2014 \u0644\u0643\u0646\u0647 \u0628\u0634\u0643\u0644 \u062d\u0627\u0633\u0645 <strong>\u0644\u0627<\/strong> \u064a\u0645\u0644\u0643 \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0623\u0633\u0631\u0627\u0631 \u0627\u0644\u0645\u0633\u062a\u0648\u062f\u0639. \u0623\u0645\u0627 \u062d\u062f\u062b <code>pull_request_target<\/code> \u0641\u064a\u064f\u0634\u063a\u0651\u0644 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0645\u0646 \u0627\u0644\u0641\u0631\u0639 <strong>\u0627\u0644\u0623\u0633\u0627\u0633\u064a<\/strong> (\u0627\u0644\u0641\u0631\u0639 \u0627\u0644\u0631\u0626\u064a\u0633\u064a \u0644\u0645\u0633\u062a\u0648\u062f\u0639\u0643) <strong>\u0648\u064a\u0645\u0644\u0643<\/strong> \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631.<\/p>\n<p>\u064a\u0646\u0634\u0623 \u0627\u0644\u062e\u0637\u0631 \u0639\u0646\u062f\u0645\u0627 \u062a\u0642\u0648\u0645 \u0633\u064a\u0631 \u0639\u0645\u0644 <code>pull_request_target<\/code> \u0628\u0633\u062d\u0628 \u0634\u064a\u0641\u0631\u0629 \u0641\u0631\u0639 head \u0627\u0644\u062e\u0627\u0635 \u0628\u0637\u0644\u0628 \u0627\u0644\u0633\u062d\u0628:<\/p>\n<pre><code># DANGEROUS: pull_request_target with explicit checkout of PR code\non: pull_request_target\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v4\n        with:\n          ref: ${{ github.event.pull_request.head.sha }}\n      # This now runs UNTRUSTED CODE with access to SECRETS\n      - run: npm install && npm test\n<\/code><\/pre>\n<p>\u064a\u0645\u0646\u062d \u0647\u0630\u0627 \u0627\u0644\u0646\u0645\u0637 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0644\u0642\u062f\u0631\u0629 \u0639\u0644\u0649 \u062a\u0646\u0641\u064a\u0630 \u0634\u064a\u0641\u0631\u0629 \u0639\u0634\u0648\u0627\u0626\u064a\u0629 \u0645\u0639 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0623\u0633\u0631\u0627\u0631 \u0645\u0633\u062a\u0648\u062f\u0639\u0643. \u0648\u0647\u0648 \u0627\u0644\u0645\u062b\u0627\u0644 \u0627\u0644\u0646\u0645\u0648\u0630\u062c\u064a \u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0645\u0633\u0645\u0648\u0645\u0629 (poisoned pipeline execution) \u0641\u064a GitHub Actions.<\/p>\n<h3>\u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0648\u062a\u0641\u0648\u064a\u0636 \u0627\u0644\u062b\u0642\u0629 (Reusable Workflows)<\/h3>\n<p>\u062a\u062a\u064a\u062d \u0644\u0643 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0645\u0631\u0643\u0632\u0629 \u0645\u0646\u0637\u0642 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0641\u064a \u0645\u0633\u062a\u0648\u062f\u0639 \u0645\u0634\u062a\u0631\u0643 \u0648\u0627\u0633\u062a\u062f\u0639\u0627\u0621\u0647\u0627 \u0645\u0646 \u0645\u0633\u062a\u0648\u062f\u0639\u0627\u062a \u0623\u062e\u0631\u0649. \u0639\u0646\u062f \u0627\u0633\u062a\u062f\u0639\u0627\u0621 \u0633\u064a\u0631 \u0639\u0645\u0644 \u0642\u0627\u0628\u0644 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645\u060c \u064a\u0639\u0645\u0644 \u0628\u0623\u0630\u0648\u0646\u0627\u062a \u0648\u0623\u0633\u0631\u0627\u0631 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 <strong>\u0627\u0644\u0645\u064f\u0633\u062a\u062f\u0639\u064a<\/strong>. \u064a\u064f\u0646\u0634\u0626 \u0647\u0630\u0627 \u0633\u0644\u0633\u0644\u0629 \u062a\u0641\u0648\u064a\u0636 \u062b\u0642\u0629: \u0623\u0646\u062a \u062a\u062b\u0642 \u0628\u0623\u0646 \u0634\u064a\u0641\u0631\u0629 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0627\u0644\u0642\u0627\u0628\u0644 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 (\u0641\u064a \u0645\u0633\u062a\u0648\u062f\u0639 \u0622\u062e\u0631) \u0633\u062a\u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0623\u0633\u0631\u0627\u0631\u0643 \u0628\u0645\u0633\u0624\u0648\u0644\u064a\u0629.<\/p>\n<p>\u062b\u0628\u0651\u062a \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0639\u0644\u0649 SHA commit \u0645\u062d\u062f\u062f\u060c \u0648\u0644\u064a\u0633 \u0639\u0644\u0649 \u0641\u0631\u0639 \u0623\u0648 \u0648\u0633\u0645:<\/p>\n<pre><code>jobs:\n  deploy:\n    uses: my-org\/shared-workflows\/.github\/workflows\/deploy.yml@a1b2c3d4e5f6\n    secrets: inherit\n<\/code><\/pre>\n<h3>\u0642\u0648\u0627\u0639\u062f \u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0628\u064a\u0626\u0629 (Environment Protection Rules)<\/h3>\n<p>\u062a\u0648\u0641\u0631 GitHub Environments \u062d\u062f \u062b\u0642\u0629 \u062d\u0627\u0633\u0645\u0627\u064b \u0644\u0633\u064a\u0631 \u0639\u0645\u0644 \u0627\u0644\u0646\u0634\u0631. \u064a\u0645\u0643\u0646\u0643 \u062a\u0643\u0648\u064a\u0646 \u0645\u0631\u0627\u062c\u0639\u064a\u0646 \u0645\u0637\u0644\u0648\u0628\u064a\u0646 \u0648\u0645\u0624\u0642\u062a\u0627\u062a \u0627\u0646\u062a\u0638\u0627\u0631 \u0648\u0642\u064a\u0648\u062f \u0641\u0631\u0648\u0639 \u0639\u0644\u0649 \u0627\u0644\u0628\u064a\u0626\u0627\u062a. \u0639\u0646\u062f\u0645\u0627 \u062a\u0634\u064a\u0631 \u0645\u0647\u0645\u0629 \u0625\u0644\u0649 \u0628\u064a\u0626\u0629\u060c \u064a\u062c\u0628 \u0623\u0646 \u062a\u0633\u062a\u0648\u0641\u064a \u0642\u0648\u0627\u0639\u062f \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0642\u0628\u0644 \u0625\u062a\u0627\u062d\u0629 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0627\u0644\u0645\u0631\u062a\u0628\u0637\u0629 \u0628\u062a\u0644\u0643 \u0627\u0644\u0628\u064a\u0626\u0629:<\/p>\n<pre><code>jobs:\n  deploy-production:\n    runs-on: ubuntu-latest\n    environment:\n      name: production\n      url: https:\/\/example.com\n    steps:\n      - name: Deploy\n        run: .\/deploy.sh\n        env:\n          AWS_ACCESS_KEY_ID: ${{ secrets.PROD_AWS_KEY }}\n<\/code><\/pre>\n<p>\u064a\u0636\u0645\u0646 \u0647\u0630\u0627 \u0623\u0646\u0647 \u062d\u062a\u0649 \u0644\u0648 \u062a\u0645 \u062a\u0634\u063a\u064a\u0644 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644\u060c \u0644\u0646 \u062a\u064f\u0643\u0634\u0641 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u0628\u062f\u0648\u0646 \u0645\u0648\u0627\u0641\u0642\u0629 \u0628\u0634\u0631\u064a\u0629.<\/p>\n<h2>\u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 GitLab CI<\/h2>\n<p>\u064a\u062a\u0645\u064a\u0632 GitLab CI \u0628\u0646\u0645\u0648\u0630\u062c \u062a\u0646\u0641\u064a\u0630 \u0645\u062e\u062a\u0644\u0641 \u0645\u0639 \u062e\u0635\u0627\u0626\u0635 \u062b\u0642\u0629 \u062e\u0627\u0635\u0629 \u0628\u0647\u060c \u0644\u0627 \u0633\u064a\u0645\u0627 \u062d\u0648\u0644 \u0646\u0637\u0627\u0642 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0648\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a.<\/p>\n<h3>Shared Runners \u0645\u0642\u0627\u0628\u0644 Group Runners \u0645\u0642\u0627\u0628\u0644 Project Runners<\/h3>\n<p>\u064a\u0642\u062f\u0645 GitLab \u062b\u0644\u0627\u062b\u0629 \u0645\u0633\u062a\u0648\u064a\u0627\u062a \u0645\u0646 \u0646\u0637\u0627\u0642 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a. <strong>Shared runners<\/strong> (\u0639\u0644\u0649 GitLab.com\u060c \u062a\u064f\u062f\u0627\u0631 \u0628\u0648\u0627\u0633\u0637\u0629 GitLab) \u0645\u062a\u0627\u062d\u0629 \u0644\u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0634\u0627\u0631\u064a\u0639. <strong>Group runners<\/strong> \u0645\u062a\u0627\u062d\u0629 \u0644\u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0634\u0627\u0631\u064a\u0639 \u0636\u0645\u0646 \u0645\u062c\u0645\u0648\u0639\u0629 GitLab. <strong>Project runners<\/strong> \u0645\u062e\u0635\u0635\u0629 \u0644\u0645\u0634\u0631\u0648\u0639 \u0648\u0627\u062d\u062f. \u064a\u062d\u062f\u062f \u0627\u0644\u0646\u0637\u0627\u0642 \u0646\u0635\u0641 \u0642\u0637\u0631 \u0627\u0644\u0627\u0646\u0641\u062c\u0627\u0631 \u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0645\u062e\u062a\u0631\u0642 \u2014 \u0627\u062e\u062a\u0631\u0627\u0642 shared runner \u064a\u0624\u062b\u0631 \u0639\u0644\u0649 \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0634\u0627\u0631\u064a\u0639\u060c \u0628\u064a\u0646\u0645\u0627 \u0627\u062e\u062a\u0631\u0627\u0642 project runner \u0645\u062d\u0635\u0648\u0631 \u0628\u0645\u0634\u0631\u0648\u0639 \u0648\u0627\u062d\u062f.<\/p>\n<p>\u0644\u0644\u0623\u062d\u0645\u0627\u0644 \u0627\u0644\u062d\u0633\u0627\u0633\u0629\u060c \u0627\u0633\u062a\u062e\u062f\u0645 \u062f\u0627\u0626\u0645\u0627\u064b \u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u062e\u0627\u0635\u0629 \u0628\u0627\u0644\u0645\u0634\u0631\u0648\u0639 \u0645\u0639 \u0648\u0633\u0648\u0645 \u0645\u0646\u0627\u0633\u0628\u0629:<\/p>\n<pre><code>deploy-production:\n  stage: deploy\n  tags:\n    - production-runner\n    - isolated\n  script:\n    - .\/deploy.sh\n  rules:\n    - if: $CI_COMMIT_BRANCH == \"main\"\n<\/code><\/pre>\n<h3>\u0627\u0644\u0641\u0631\u0648\u0639 \u0627\u0644\u0645\u062d\u0645\u064a\u0629 \u0648\u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u062d\u0645\u064a\u0629 (Protected Branches and Protected Variables)<\/h3>\n<p>\u062a\u064f\u0639\u062f\u0651 \u0622\u0644\u064a\u0629 \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u062d\u0645\u064a\u0629 \u0641\u064a GitLab \u0636\u0627\u0628\u0637 \u062b\u0642\u0629 \u0631\u0626\u064a\u0633\u064a\u0627\u064b. \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u064f\u0639\u0644\u064e\u0651\u0645\u0629 \u0643\u0640 &#8220;\u0645\u062d\u0645\u064a\u0629&#8221; \u062a\u064f\u0643\u0634\u0641 \u0641\u0642\u0637 \u0644\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u062a\u064a \u062a\u0639\u0645\u0644 \u0639\u0644\u0649 \u0641\u0631\u0648\u0639 \u0645\u062d\u0645\u064a\u0629 \u0623\u0648 \u0648\u0633\u0648\u0645 \u0645\u062d\u0645\u064a\u0629. \u0647\u0630\u0627 \u064a\u0639\u0646\u064a \u0623\u0646 \u0623\u0646\u0628\u0648\u0628\u0629 \u062a\u064f\u0634\u063a\u064e\u0651\u0644 \u0628\u0648\u0627\u0633\u0637\u0629 \u0637\u0644\u0628 \u062f\u0645\u062c \u0645\u0646 \u0641\u0631\u0639 \u0645\u064a\u0632\u0629 \u2014 \u0623\u0648 \u0623\u0633\u0648\u0623 \u0645\u0646 \u0630\u0644\u0643\u060c \u0645\u0646 fork \u2014 \u0644\u0646 \u062a\u0645\u0644\u0643 \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u062d\u0645\u064a\u0629.<\/p>\n<p>\u0647\u0630\u0647 \u0647\u064a \u0627\u0644\u0622\u0644\u064a\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629 \u0641\u064a GitLab \u0644\u0645\u0646\u0639 \u0643\u0634\u0641 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0644\u0644\u0634\u064a\u0641\u0631\u0629 \u063a\u064a\u0631 \u0627\u0644\u0645\u0648\u062b\u0648\u0642\u0629:<\/p>\n<pre><code># In .gitlab-ci.yml, protected variables are only available on protected branches\ndeploy:\n  stage: deploy\n  script:\n    - echo \"Deploying with $PRODUCTION_API_KEY\"\n  rules:\n    - if: $CI_COMMIT_BRANCH == \"main\"  # main is a protected branch\n  environment:\n    name: production\n<\/code><\/pre>\n<h3>\u0646\u0637\u0627\u0642 \u0648\u0642\u064a\u0648\u062f CI_JOB_TOKEN<\/h3>\n<p>\u062a\u062a\u0644\u0642\u0649 \u0643\u0644 \u0645\u0647\u0645\u0629 GitLab CI \u0631\u0645\u0632 <code>CI_JOB_TOKEN<\/code>\u060c \u0648\u0647\u0648 \u0631\u0645\u0632 \u064a\u064f\u0646\u0634\u0623 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b \u0648\u0645\u062d\u062f\u062f \u0627\u0644\u0646\u0637\u0627\u0642 \u0644\u0644\u0645\u0634\u0631\u0648\u0639. \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b\u060c \u064a\u0645\u0643\u0646 \u0644\u0647\u0630\u0627 \u0627\u0644\u0631\u0645\u0632 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0645\u0648\u0627\u0631\u062f \u0645\u0634\u0627\u0631\u064a\u0639 \u0623\u062e\u0631\u0649\u060c \u0645\u0645\u0627 \u064a\u064f\u0646\u0634\u0626 \u0639\u0644\u0627\u0642\u0629 \u062b\u0642\u0629 \u0636\u0645\u0646\u064a\u0629. \u064a\u0633\u0645\u062d GitLab \u0628\u062a\u0642\u064a\u064a\u062f \u0648\u0635\u0648\u0644 <code>CI_JOB_TOKEN<\/code> \u0645\u0646 \u062e\u0644\u0627\u0644 \u062a\u0643\u0648\u064a\u0646 \u0642\u0627\u0626\u0645\u0629 \u0645\u0633\u0645\u0648\u062d \u0628\u0647\u0627 \u0645\u0646 \u0627\u0644\u0645\u0634\u0627\u0631\u064a\u0639 \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u064a\u0647\u0627 \u2014 \u062e\u0637\u0648\u0629 \u062a\u0642\u0648\u064a\u0629 \u062d\u0627\u0633\u0645\u0629 \u062a\u062d\u062f \u0645\u0646 \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u062c\u0627\u0646\u0628\u064a\u0629 \u0625\u0630\u0627 \u062a\u0645 \u0627\u062e\u062a\u0631\u0627\u0642 \u0623\u0646\u0628\u0648\u0628\u0629.<\/p>\n<p>\u0641\u064a \u0625\u0639\u062f\u0627\u062f\u0627\u062a \u0645\u0634\u0631\u0648\u0639\u0643 \u0636\u0645\u0646 <strong>CI\/CD \u2192 Token Access<\/strong>\u060c \u0642\u064a\u0651\u062f \u0646\u0637\u0627\u0642 \u0627\u0644\u0631\u0645\u0632 \u0625\u0644\u0649 \u0627\u0644\u0645\u0634\u0627\u0631\u064a\u0639 \u0627\u0644\u062a\u064a \u062a\u062d\u062a\u0627\u062c \u0623\u0646\u0628\u0648\u0628\u062a\u0643 \u0641\u0639\u0644\u0627\u064b \u0644\u0644\u062a\u0641\u0627\u0639\u0644 \u0645\u0639\u0647\u0627 \u0641\u0642\u0637.<\/p>\n<h3>\u0623\u0646\u0627\u0628\u064a\u0628 \u0637\u0644\u0628 \u0627\u0644\u062f\u0645\u062c \u0648\u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629 (Merge Request Pipelines)<\/h3>\n<p>\u064a\u0645\u064a\u0651\u0632 GitLab \u0628\u064a\u0646 \u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u0641\u0631\u0639 \u0648\u0623\u0646\u0627\u0628\u064a\u0628 \u0637\u0644\u0628 \u0627\u0644\u062f\u0645\u062c. \u062a\u0639\u0645\u0644 \u0623\u0646\u0627\u0628\u064a\u0628 \u0637\u0644\u0628 \u0627\u0644\u062f\u0645\u062c \u0641\u064a \u0633\u064a\u0627\u0642 \u0637\u0644\u0628 \u0627\u0644\u062f\u0645\u062c \u0648\u0644\u0647\u0627 \u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0645\u062c\u0645\u0648\u0639\u0629 \u0645\u062d\u062f\u0648\u062f\u0629 \u0645\u0646 \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u064f\u062d\u062f\u062f\u0629 \u0645\u0633\u0628\u0642\u0627\u064b. \u0628\u0627\u0644\u0646\u0633\u0628\u0629 \u0644\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u0645\u064f\u0634\u063a\u064e\u0651\u0644\u0629 \u0628\u0648\u0627\u0633\u0637\u0629 \u0637\u0644\u0628\u0627\u062a \u062f\u0645\u062c \u0645\u0646 forks\u060c \u0644\u0627 \u064a\u0643\u0634\u0641 GitLab \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u062d\u0645\u064a\u0629 \u0623\u0648 \u0623\u0633\u0631\u0627\u0631 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0645\u0634\u0631\u0648\u0639 \u2014 \u0647\u0630\u0627 \u062d\u062f \u062b\u0642\u0629 \u0645\u0642\u0635\u0648\u062f.<\/p>\n<p>\u0648\u0645\u0639 \u0630\u0644\u0643\u060c \u0641\u0625\u0646 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u062a\u064a \u062a\u0639\u0645\u0644 \u0639\u0644\u0649 <strong>\u0627\u0644\u0646\u062a\u064a\u062c\u0629 \u0627\u0644\u0645\u062f\u0645\u062c\u0629<\/strong> (<code>merge_request_event<\/code> \u0645\u0639 \u062a\u0645\u0643\u064a\u0646 \u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u0646\u062a\u0627\u0626\u062c \u0627\u0644\u0645\u062f\u0645\u062c\u0629) \u0644\u0627 \u062a\u0632\u0627\u0644 \u062a\u064f\u0646\u0641\u0651\u0630 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0645\u0646 \u0627\u0644\u0640 fork. \u0625\u0630\u0627 \u0633\u0645\u062d \u062a\u0639\u0631\u064a\u0641 \u0623\u0646\u0628\u0648\u0628\u062a\u0643 \u0628\u062a\u0646\u0641\u064a\u0630 \u0634\u064a\u0641\u0631\u0629 \u0639\u0634\u0648\u0627\u0626\u064a\u0629 \u0648\u0643\u0627\u0646\u062a \u0627\u0644\u0645\u0647\u0645\u0629 \u062a\u0645\u0644\u0643 \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0645\u0646 \u062e\u0644\u0627\u0644 \u0645\u062a\u063a\u064a\u0631\u0627\u062a \u063a\u064a\u0631 \u0645\u062d\u0645\u064a\u0629\u060c \u0641\u0644\u0627 \u064a\u0632\u0627\u0644 \u0645\u0646 \u0627\u0644\u0645\u0645\u0643\u0646 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0630\u0644\u0643.<\/p>\n<h2>\u0625\u062e\u0641\u0627\u0642\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u0627\u062a \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u0634\u0627\u0626\u0639\u0629<\/h2>\n<p>\u0641\u0647\u0645 \u0646\u0645\u0627\u0630\u062c \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0645\u0647\u0645\u060c \u0644\u0643\u0646 \u0627\u0644\u0642\u064a\u0645\u0629 \u0627\u0644\u062d\u0642\u064a\u0642\u064a\u0629 \u062a\u0623\u062a\u064a \u0645\u0646 \u0627\u0644\u062a\u0639\u0631\u0641 \u0639\u0644\u0649 \u0627\u0644\u0623\u0646\u0645\u0627\u0637 \u0627\u0644\u062a\u064a \u062a\u0624\u062f\u064a \u0625\u0644\u0649 \u0627\u0644\u0627\u062e\u062a\u0631\u0627\u0642. \u0647\u0630\u0647 \u0647\u064a \u0625\u062e\u0641\u0627\u0642\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u0627\u062a \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u062a\u064a \u062a\u0638\u0647\u0631 \u0628\u0634\u0643\u0644 \u0645\u062a\u0643\u0631\u0631 \u0641\u064a \u0627\u062e\u062a\u0631\u0627\u0642\u0627\u062a CI\/CD \u0627\u0644\u0648\u0627\u0642\u0639\u064a\u0629.<\/p>\n<h3>\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0645\u0633\u0645\u0648\u0645\u0629 (Poisoned Pipeline Execution &#8211; PPE)<\/h3>\n<p>\u064a\u062d\u062f\u062b \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0645\u0633\u0645\u0648\u0645\u0629 \u0639\u0646\u062f\u0645\u0627 \u064a\u0633\u062a\u0637\u064a\u0639 \u0645\u0647\u0627\u062c\u0645 \u062a\u0639\u062f\u064a\u0644 \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0630\u064a \u064a\u0639\u0645\u0644 \u0641\u064a \u0633\u064a\u0627\u0642 \u0630\u064a \u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a. \u0647\u0630\u0627 \u0647\u0648 \u0627\u0644\u0641\u0626\u0629 \u0627\u0644\u0623\u0643\u062b\u0631 \u0627\u0646\u062a\u0634\u0627\u0631\u0627\u064b \u0645\u0646 \u062b\u063a\u0631\u0627\u062a CI\/CD. \u064a\u062d\u062f\u062b \u0639\u0646\u062f\u0645\u0627:<\/p>\n<ul>\n<li>\u064a\u064f\u0634\u063a\u0651\u0644 \u0637\u0644\u0628 \u0633\u062d\u0628 \u0633\u064a\u0631 \u0639\u0645\u0644 \u064a\u0633\u062a\u062e\u062f\u0645 \u0646\u0633\u062e\u0629 \u0637\u0644\u0628 \u0627\u0644\u0633\u062d\u0628 \u0645\u0646 \u0645\u0644\u0641 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629<\/li>\n<li>\u064a\u0645\u0644\u0643 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644 \u0647\u0630\u0627 \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0623\u0648 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0644\u0646\u0634\u0631<\/li>\n<li>\u0644\u0627 \u064a\u0648\u062c\u062f \u0628\u0648\u0627\u0628\u0629 \u0645\u0631\u0627\u062c\u0639\u0629 \u0623\u0648 \u0645\u0648\u0627\u0641\u0642\u0629 \u0628\u064a\u0646 \u0637\u0644\u0628 \u0627\u0644\u0633\u062d\u0628 \u0648\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629<\/li>\n<\/ul>\n<p>\u064a\u0639\u062f\u0651\u0644 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0645\u0644\u0641 YAML \u0627\u0644\u062e\u0627\u0635 \u0628\u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 (\u0623\u0648 \u0633\u0643\u0631\u064a\u0628\u062a \u062a\u0633\u062a\u062f\u0639\u064a\u0647) \u0644\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0623\u0648 \u062d\u0642\u0646 \u0623\u0628\u0648\u0627\u0628 \u062e\u0644\u0641\u064a\u0629 \u0641\u064a \u062d\u0632\u0645 \u0627\u0644\u0628\u0646\u0627\u0621 \u0623\u0648 \u0627\u0644\u062a\u0645\u062d\u0648\u0631 \u0625\u0644\u0649 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0627\u0644\u062f\u0627\u062e\u0644\u064a\u0629.<\/p>\n<h3>\u0627\u0641\u062a\u0631\u0627\u0636 \u0639\u0632\u0644 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0639\u0644\u0649 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0627\u0644\u0645\u0634\u062a\u0631\u0643\u0629<\/h3>\n<p>\u0639\u0646\u062f\u0645\u0627 \u062a\u062a\u0634\u0627\u0631\u0643 \u0641\u0631\u0642 \u0623\u0648 \u0645\u0634\u0627\u0631\u064a\u0639 \u0645\u062a\u0639\u062f\u062f\u0629 \u0641\u064a \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u2014 \u062e\u0627\u0635\u0629 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u2014 \u063a\u0627\u0644\u0628\u0627\u064b \u0645\u0627 \u064a\u0643\u0648\u0646 \u0647\u0646\u0627\u0643 \u0627\u0641\u062a\u0631\u0627\u0636 \u0636\u0645\u0646\u064a \u0644\u0644\u0639\u0632\u0644 \u0644\u0627 \u064a\u0648\u062c\u062f \u0641\u0639\u0644\u064a\u0627\u064b. \u064a\u0645\u0643\u0646 \u0644\u0645\u0647\u0645\u0629 \u062a\u0639\u0645\u0644 \u0639\u0644\u0649 \u0645\u064f\u0634\u063a\u0651\u0644 \u0630\u0627\u062a\u064a \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0634\u062a\u0631\u0643 \u0623\u0646:<\/p>\n<ul>\n<li>\u062a\u0642\u0631\u0623 \u0645\u0644\u0641\u0627\u062a \u062a\u0631\u0643\u062a\u0647\u0627 \u0645\u0647\u0627\u0645 \u0633\u0627\u0628\u0642\u0629 (\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0645\u062e\u0628\u0623\u0629\u060c \u062d\u0632\u0645 \u0628\u0646\u0627\u0621)<\/li>\n<li>\u062a\u0635\u0644 \u0625\u0644\u0649 Docker socket \u0648\u062a\u0641\u062d\u0635 \u0623\u0648 \u062a\u0639\u062f\u0651\u0644 \u062d\u0627\u0648\u064a\u0627\u062a \u0623\u062e\u0631\u0649<\/li>\n<li>\u062a\u0635\u0644 \u0625\u0644\u0649 \u0645\u0648\u0627\u0631\u062f \u0627\u0644\u0634\u0628\u0643\u0629 \u0627\u0644\u062f\u0627\u062e\u0644\u064a\u0629 \u0627\u0644\u0645\u062a\u0627\u062d\u0629 \u0644\u0645\u0636\u064a\u0641 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644<\/li>\n<li>\u062a\u062b\u0628\u0651\u062a \u0623\u0628\u0648\u0627\u0628\u0627\u064b \u062e\u0644\u0641\u064a\u0629 \u0645\u0633\u062a\u0645\u0631\u0629 \u0639\u0644\u0649 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0644\u0644\u0645\u0647\u0627\u0645 \u0627\u0644\u0645\u0633\u062a\u0642\u0628\u0644\u064a\u0629<\/li>\n<\/ul>\n<h3>\u062d\u0633\u0627\u0628\u0627\u062a \u0627\u0644\u062e\u062f\u0645\u0629 \u0630\u0627\u062a \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u0627\u0644\u0645\u0641\u0631\u0637\u0629<\/h3>\n<p>\u0645\u0646 \u0627\u0644\u0623\u0646\u0645\u0627\u0637 \u0627\u0644\u0634\u0627\u0626\u0639\u0629 \u0628\u0634\u0643\u0644 \u0645\u0642\u0644\u0642 \u0645\u0646\u062d \u062d\u0633\u0627\u0628 \u062e\u062f\u0645\u0629 CI\/CD \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u062f\u0627\u0631\u064a\u0627\u064b \u0648\u0627\u0633\u0639\u0627\u064b \u2014 &#8220;\u0641\u0642\u0637 \u0644\u062c\u0639\u0644 \u0627\u0644\u0623\u0645\u0648\u0631 \u062a\u0639\u0645\u0644&#8221;. \u062f\u0648\u0631 AWS IAM \u0645\u0639 <code>AdministratorAccess<\/code>\u060c \u0623\u0648 \u062d\u0633\u0627\u0628 \u062e\u062f\u0645\u0629 Kubernetes \u0645\u0639 <code>cluster-admin<\/code>\u060c \u0623\u0648 \u062d\u0633\u0627\u0628 cloud SQL \u0628\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a DBA. \u0639\u0646\u062f \u0627\u062e\u062a\u0631\u0627\u0642 \u0623\u064a \u062e\u0637\u0648\u0629 \u0641\u064a \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629\u060c \u064a\u0631\u062b \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u062c\u0645\u064a\u0639 \u0647\u0630\u0647 \u0627\u0644\u0623\u0630\u0648\u0646\u0627\u062a.<\/p>\n<h3>\u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u0636\u0645\u0646\u064a\u0629 \u0641\u064a Actions \u0648\u0627\u0644\u0642\u0648\u0627\u0644\u0628 \u0645\u0646 \u062c\u0647\u0627\u062a \u062e\u0627\u0631\u062c\u064a\u0629<\/h3>\n<p>\u0627\u0633\u062a\u062e\u062f\u0627\u0645 GitHub Actions \u0623\u0648 \u0642\u0648\u0627\u0644\u0628 GitLab CI \u0645\u0646 \u0627\u0644\u0645\u062c\u062a\u0645\u0639 \u064a\u0639\u0646\u064a \u062a\u0646\u0641\u064a\u0630 \u0634\u064a\u0641\u0631\u0629 \u0634\u062e\u0635 \u0622\u062e\u0631 \u0641\u064a \u0623\u0646\u0628\u0648\u0628\u062a\u0643 \u0645\u0639 \u0623\u0633\u0631\u0627\u0631\u0643. \u0639\u0646\u062f\u0645\u0627 \u062a\u0634\u064a\u0631 \u0625\u0644\u0649 <code>uses: some-org\/some-action@v2<\/code>\u060c \u0641\u0623\u0646\u062a \u062a\u062b\u0642 \u0628\u0623\u0646:<\/p>\n<ul>\n<li>\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0640 action \u0644\u064a\u0633\u062a \u062e\u0628\u064a\u062b\u0629<\/li>\n<li>\u0645\u0634\u0631\u0641\u0648 \u0627\u0644\u0640 action \u0644\u0645 \u064a\u062a\u0639\u0631\u0636\u0648\u0627 \u0644\u0644\u0627\u062e\u062a\u0631\u0627\u0642<\/li>\n<li>\u0648\u0633\u0645 <code>v2<\/code> \u0644\u0645 \u064a\u064f\u0646\u0642\u0644 \u0644\u064a\u0634\u064a\u0631 \u0625\u0644\u0649 \u0634\u064a\u0641\u0631\u0629 \u0645\u062e\u062a\u0644\u0641\u0629<\/li>\n<li>\u062a\u0628\u0639\u064a\u0627\u062a \u0627\u0644\u0640 action \u062c\u062f\u064a\u0631\u0629 \u0628\u0627\u0644\u062b\u0642\u0629<\/li>\n<\/ul>\n<p>\u0645\u0631\u0627\u062c\u0639 \u0627\u0644\u0648\u0633\u0648\u0645 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u063a\u064a\u064a\u0631. \u064a\u0645\u0643\u0646 \u0644\u0645\u0647\u0627\u062c\u0645 \u064a\u062e\u062a\u0631\u0642 \u0645\u0633\u062a\u0648\u062f\u0639 action \u0646\u0642\u0644 \u0648\u0633\u0645 <code>v2<\/code> \u0625\u0644\u0649 commit \u062e\u0628\u064a\u062b\u060c \u0648\u0643\u0644 \u0623\u0646\u0628\u0648\u0628\u0629 \u062a\u0634\u064a\u0631 \u0625\u0644\u0649 \u0630\u0644\u0643 \u0627\u0644\u0648\u0633\u0645 \u0633\u062a\u064f\u0646\u0641\u0651\u0630 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062c\u062f\u064a\u062f\u0629 \u0641\u064a \u062a\u0634\u063a\u064a\u0644\u0647\u0627 \u0627\u0644\u062a\u0627\u0644\u064a.<\/p>\n<h3>\u0627\u0644\u062e\u0644\u0637 \u0628\u064a\u0646 \u0647\u0648\u064a\u0629 \u0648\u0642\u062a \u0627\u0644\u0628\u0646\u0627\u0621 \u0648\u0647\u0648\u064a\u0629 \u0648\u0642\u062a \u0627\u0644\u0646\u0634\u0631<\/h3>\n<p>\u062a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0639\u062f\u064a\u062f \u0645\u0646 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0647\u0648\u064a\u0629 \u0648\u0627\u062d\u062f\u0629 (\u062d\u0633\u0627\u0628 \u062e\u062f\u0645\u0629 \u0623\u0648 \u062f\u0648\u0631 IAM \u0623\u0648 \u0631\u0645\u0632 \u0645\u0645\u064a\u0632) \u0644\u0643\u0644 \u0645\u0646 \u0627\u0644\u0628\u0646\u0627\u0621 \u0648\u0627\u0644\u0646\u0634\u0631. \u0647\u0630\u0627 \u0627\u0644\u062f\u0645\u062c \u064a\u0639\u0646\u064a \u0623\u0646 \u0627\u0644\u0627\u062e\u062a\u0631\u0627\u0642 \u0623\u062b\u0646\u0627\u0621 \u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u0628\u0646\u0627\u0621 \u2014 \u0627\u0644\u062a\u064a \u062a\u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0634\u064a\u0641\u0631\u0629 \u063a\u064a\u0631 \u0645\u0648\u062b\u0648\u0642\u0629 \u2014 \u064a\u0645\u0646\u062d \u0648\u0635\u0648\u0644\u0627\u064b \u0645\u0628\u0627\u0634\u0631\u0627\u064b \u0625\u0644\u0649 \u0623\u0647\u062f\u0627\u0641 \u0627\u0644\u0646\u0634\u0631. \u064a\u062c\u0628 \u0623\u0646 \u062a\u0643\u0648\u0646 \u0647\u0648\u064a\u0629 \u0627\u0644\u0628\u0646\u0627\u0621 \u0642\u0627\u062f\u0631\u0629 \u0641\u0642\u0637 \u0639\u0644\u0649 \u0625\u0646\u062a\u0627\u062c \u0627\u0644\u062d\u0632\u0645. \u064a\u062c\u0628 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0647\u0648\u064a\u0629 \u0646\u0634\u0631 \u0645\u0646\u0641\u0635\u0644\u0629 \u0648\u0623\u0643\u062b\u0631 \u062a\u0642\u064a\u064a\u062f\u0627\u064b \u0644\u0646\u0634\u0631 \u062a\u0644\u0643 \u0627\u0644\u062d\u0632\u0645 \u0641\u064a \u0627\u0644\u0625\u0646\u062a\u0627\u062c.<\/p>\n<h2>\u062a\u0642\u0648\u064a\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u0627\u062a \u0627\u0644\u062b\u0642\u0629<\/h2>\n<p>\u0645\u0639 \u0648\u0636\u0648\u062d \u0646\u0645\u0648\u0630\u062c \u0627\u0644\u062a\u0647\u062f\u064a\u062f\u060c \u0625\u0644\u064a\u0643 \u0627\u0644\u062a\u062f\u0627\u0628\u064a\u0631 \u0627\u0644\u0645\u0644\u0645\u0648\u0633\u0629 \u0627\u0644\u062a\u064a \u062a\u064f\u0648\u0627\u0626\u0645 \u0627\u0644\u0636\u0648\u0627\u0628\u0637 \u0645\u0639 \u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629.<\/p>\n<h3>\u0634\u0631\u0648\u0637 \u0627\u0644\u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u0635\u0631\u064a\u062d\u0629 \u0648\u0645\u0631\u0634\u062d\u0627\u062a \u0627\u0644\u0641\u0631\u0648\u0639<\/h3>\n<p>\u0644\u0627 \u062a\u0633\u0645\u062d \u0623\u0628\u062f\u0627\u064b \u0628\u0645\u064f\u062d\u0641\u0650\u0651\u0632\u0627\u062a \u0623\u0646\u0628\u0648\u0628\u0629 \u063a\u064a\u0631 \u0645\u0642\u064a\u062f\u0629. \u062d\u062f\u0651\u062f \u0627\u0644\u0623\u062d\u062f\u0627\u062b \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646\u0647\u0627 \u062a\u0634\u063a\u064a\u0644 \u0633\u064a\u0631 \u0627\u0644\u0639\u0645\u0644\u060c \u0648\u062a\u0623\u0643\u062f \u0645\u0646 \u0623\u0646 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0630\u0627\u062a \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u062a\u0639\u0645\u0644 \u0641\u0642\u0637 \u0639\u0644\u0649 \u0641\u0631\u0648\u0639 \u0645\u0648\u062b\u0648\u0642\u0629:<\/p>\n<pre><code># GitHub Actions: restrict deployment to main branch only\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n    # Only trigger on PRs targeting main; PR code runs without secrets\n\njobs:\n  deploy:\n    if: github.event_name == 'push' && github.ref == 'refs\/heads\/main'\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\/checkout@v4\n      - run: .\/deploy.sh\n<\/code><\/pre>\n<pre><code># GitLab CI: use rules to restrict sensitive jobs\ndeploy-production:\n  stage: deploy\n  script:\n    - .\/deploy.sh\n  rules:\n    - if: $CI_COMMIT_BRANCH == \"main\" && $CI_PIPELINE_SOURCE != \"merge_request_event\"\n      when: manual\n      allow_failure: false\n  environment:\n    name: production\n<\/code><\/pre>\n<h3>\u0623\u0630\u0648\u0646\u0627\u062a \u0627\u0644\u0631\u0645\u0648\u0632 \u0627\u0644\u0645\u0645\u064a\u0632\u0629 \u0628\u0627\u0644\u062d\u062f \u0627\u0644\u0623\u062f\u0646\u0649<\/h3>\n<p>\u0637\u0628\u0651\u0642 \u0645\u0628\u062f\u0623 \u0627\u0644\u062d\u062f \u0627\u0644\u0623\u062f\u0646\u0649 \u0645\u0646 \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u0639\u0644\u0649 \u0643\u0644 \u0631\u0645\u0632 \u0641\u064a \u0623\u0646\u0628\u0648\u0628\u062a\u0643. \u0641\u064a GitHub Actions\u060c \u0639\u064a\u0651\u0646 \u0623\u0630\u0648\u0646\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0645\u0642\u064a\u0651\u062f\u0629 \u0648\u0627\u0645\u0646\u062d \u0623\u0630\u0648\u0646\u0627\u062a \u0645\u062d\u062f\u062f\u0629 \u0644\u0643\u0644 \u0645\u0647\u0645\u0629:<\/p>\n<pre><code># Set restrictive defaults at the workflow level\npermissions: read-all\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      packages: write\n    steps:\n      - uses: actions\/checkout@v4\n      - run: npm ci && npm run build\n\n  deploy:\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      id-token: write  # Only for OIDC, no write to repo\n    environment: production\n    steps:\n      - run: .\/deploy.sh\n<\/code><\/pre>\n<p>\u0641\u064a GitLab\u060c \u0642\u064a\u0651\u062f \u0646\u0637\u0627\u0642 <code>CI_JOB_TOKEN<\/code> \u0641\u064a \u0625\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0645\u0634\u0631\u0648\u0639 \u0648\u0627\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0645\u062a\u063a\u064a\u0631\u0627\u062a \u0627\u0644\u0645\u062d\u0645\u064a\u0629 \u062d\u0635\u0631\u064a\u0627\u064b \u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0644\u062d\u0633\u0627\u0633\u0629.<\/p>\n<h3>\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0645\u0624\u0642\u062a\u0629 \u0648\u0645\u0639\u0632\u0648\u0644\u0629<\/h3>\n<p>\u062d\u064a\u062b\u0645\u0627 \u0623\u0645\u0643\u0646\u060c \u0627\u0633\u062a\u062e\u062f\u0645 \u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0645\u0624\u0642\u062a\u0629 \u062a\u064f\u0646\u0634\u0623 \u0645\u0646 \u062c\u062f\u064a\u062f \u0644\u0643\u0644 \u0645\u0647\u0645\u0629 \u0648\u062a\u064f\u062f\u0645\u064e\u0651\u0631 \u0641\u0648\u0631 \u0627\u0646\u062a\u0647\u0627\u0626\u0647\u0627. \u064a\u0642\u0636\u064a \u0647\u0630\u0627 \u0639\u0644\u0649 \u0627\u0644\u0647\u062c\u0645\u0627\u062a \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u0639\u0644\u0649 \u0627\u0644\u0627\u0633\u062a\u0645\u0631\u0627\u0631\u064a\u0629 \u0648\u062a\u0633\u0631\u0628 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0628\u064a\u0646 \u0627\u0644\u0645\u0647\u0627\u0645. \u0644\u0644\u0628\u064a\u0626\u0627\u062a \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629\u060c \u064a\u0645\u0643\u0646 \u0644\u0623\u062f\u0648\u0627\u062a \u0645\u062b\u0644 <a href=\"https:\/\/github.com\/actions\/actions-runner-controller\" target=\"_blank\" rel=\"noopener\">Actions Runner Controller<\/a> (ARC) \u0644\u0640 Kubernetes \u0645\u0646 GitHub \u0623\u0648 \u0645\u064f\u0634\u063a\u0651\u0644 GitLab \u0627\u0644\u0642\u0627\u0628\u0644 \u0644\u0644\u062a\u0648\u0633\u0639 \u0627\u0644\u062a\u0644\u0642\u0627\u0626\u064a \u0639\u0644\u0649 AWS\/GCP \u062a\u0648\u0641\u064a\u0631 pods \u0623\u0648 \u0622\u0644\u0627\u062a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0645\u0624\u0642\u062a\u0629 \u0644\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0644\u0643\u0644 \u0645\u0647\u0645\u0629.<\/p>\n<p>\u0627\u0644\u062e\u0635\u0627\u0626\u0635 \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u062a\u0643\u0648\u064a\u0646 \u0645\u064f\u0634\u063a\u0651\u0644 \u0645\u0642\u0648\u0651\u0649:<\/p>\n<ul>\n<li>\u0644\u0627 \u062a\u062e\u0632\u064a\u0646 \u0645\u0633\u062a\u0645\u0631 \u0628\u064a\u0646 \u0627\u0644\u0645\u0647\u0627\u0645<\/li>\n<li>\u0644\u0627 Docker socket \u0645\u0634\u062a\u0631\u0643<\/li>\n<li>\u062a\u062c\u0632\u0626\u0629 \u0634\u0628\u0643\u064a\u0629 \u062a\u062d\u062f\u0651 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0627\u0644\u0646\u0642\u0627\u0637 \u0627\u0644\u0646\u0647\u0627\u0626\u064a\u0629 \u0627\u0644\u0645\u0637\u0644\u0648\u0628\u0629 \u0641\u0642\u0637<\/li>\n<li>\u0644\u0627 \u0642\u062f\u0631\u0629 \u0644\u0644\u0645\u0647\u0645\u0629 \u0639\u0644\u0649 \u062a\u0639\u062f\u064a\u0644 \u062a\u0643\u0648\u064a\u0646 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644 \u0646\u0641\u0633\u0647<\/li>\n<\/ul>\n<h3>\u062a\u062b\u0628\u064a\u062a Actions \u0648\u0627\u0644\u0635\u0648\u0631 \u0628\u0648\u0627\u0633\u0637\u0629 SHA<\/h3>\n<p>\u064a\u0645\u0643\u0646 \u062a\u063a\u064a\u064a\u0631 \u0627\u0644\u0645\u0631\u0627\u062c\u0639 \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u063a\u064a\u064a\u0631 (\u0623\u0633\u0645\u0627\u0621 \u0627\u0644\u0641\u0631\u0648\u0639\u060c \u0648\u0633\u0648\u0645 \u0645\u062b\u0644 <code>v2<\/code>) \u0628\u0648\u0627\u0633\u0637\u0629 \u0627\u0644\u0645\u0634\u0631\u0641\u064a\u0646 \u0627\u0644\u0623\u0635\u0644\u064a\u064a\u0646 \u2014 \u0623\u0648 \u0627\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646. \u0627\u0644\u062a\u062b\u0628\u064a\u062a \u0639\u0644\u0649 SHA commit \u0645\u062d\u062f\u062f \u064a\u0636\u0645\u0646 \u0623\u0646 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062a\u064a \u0631\u0627\u062c\u0639\u062a\u0647\u0627 \u0628\u0627\u0644\u0636\u0628\u0637 \u0647\u064a \u0645\u0627 \u064a\u0639\u0645\u0644 \u0641\u064a \u0623\u0646\u0628\u0648\u0628\u062a\u0643:<\/p>\n<pre><code># Instead of this (mutable tag):\n- uses: actions\/checkout@v4\n\n# Use this (immutable SHA):\n- uses: actions\/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1\n<\/code><\/pre>\n<p>\u064a\u0646\u0637\u0628\u0642 \u0646\u0641\u0633 \u0627\u0644\u0645\u0628\u062f\u0623 \u0639\u0644\u0649 \u0635\u0648\u0631 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a. \u0627\u0633\u062a\u062e\u062f\u0645 image digests \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0627\u0644\u0648\u0633\u0648\u0645:<\/p>\n<pre><code># Instead of:\nimage: node:20-alpine\n\n# Use:\nimage: node@sha256:a1b2c3d4e5f6...  # pin to specific digest\n<\/code><\/pre>\n<p>\u064a\u0645\u0643\u0646 \u0644\u0623\u062f\u0648\u0627\u062a \u0645\u062b\u0644 Dependabot \u0648Renovate \u0625\u0646\u0634\u0627\u0621 \u0637\u0644\u0628\u0627\u062a \u0633\u062d\u0628 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b \u0644\u062a\u062d\u062f\u064a\u062b SHAs \u0627\u0644\u0645\u064f\u062b\u0628\u064e\u0651\u062a\u0629 \u0639\u0646\u062f \u0625\u0635\u062f\u0627\u0631 \u0646\u0633\u062e \u062c\u062f\u064a\u062f\u0629\u060c \u0641\u062a\u062d\u0635\u0644 \u0639\u0644\u0649 \u0627\u0644\u0623\u0645\u0627\u0646 \u0648\u0633\u0647\u0648\u0644\u0629 \u0627\u0644\u0635\u064a\u0627\u0646\u0629 \u0645\u0639\u0627\u064b.<\/p>\n<h3>\u0641\u0635\u0644 \u0647\u0648\u064a\u0627\u062a \u0627\u0644\u0628\u0646\u0627\u0621 \u0648\u0627\u0644\u0646\u0634\u0631<\/h3>\n<p>\u0646\u0641\u0651\u0630 \u0647\u0648\u064a\u0627\u062a \u0645\u0645\u064a\u0632\u0629 \u0644\u0645\u0631\u062d\u0644\u062a\u064a \u0627\u0644\u0628\u0646\u0627\u0621 \u0648\u0627\u0644\u0646\u0634\u0631. \u064a\u062c\u0628 \u0623\u0646 \u062a\u0645\u0644\u0643 \u0647\u0648\u064a\u0629 \u0627\u0644\u0628\u0646\u0627\u0621:<\/p>\n<ul>\n<li>\u0648\u0635\u0648\u0644 \u0642\u0631\u0627\u0621\u0629 \u0644\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629<\/li>\n<li>\u0648\u0635\u0648\u0644 \u0643\u062a\u0627\u0628\u0629 \u0644\u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u062d\u0632\u0645 (container registry \u0623\u0648 S3 bucket)<\/li>\n<li>\u0644\u0627 \u0648\u0635\u0648\u0644 \u0644\u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0625\u0646\u062a\u0627\u062c<\/li>\n<\/ul>\n<p>\u064a\u062c\u0628 \u0623\u0646 \u062a\u0645\u0644\u0643 \u0647\u0648\u064a\u0629 \u0627\u0644\u0646\u0634\u0631:<\/p>\n<ul>\n<li>\u0648\u0635\u0648\u0644 \u0642\u0631\u0627\u0621\u0629 \u0644\u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u062d\u0632\u0645<\/li>\n<li>\u0648\u0635\u0648\u0644 \u0643\u062a\u0627\u0628\u0629 \u0644\u0647\u062f\u0641 \u0627\u0644\u0646\u0634\u0631 \u0627\u0644\u0645\u062d\u062f\u062f<\/li>\n<li>\u0644\u0627 \u0648\u0635\u0648\u0644 \u0644\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0623\u0648 \u0627\u0644\u0642\u062f\u0631\u0629 \u0639\u0644\u0649 \u062a\u0634\u063a\u064a\u0644 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0628\u0646\u0627\u0621<\/li>\n<\/ul>\n<p>\u0627\u0633\u062a\u062e\u062f\u0645 OIDC federation \u062d\u064a\u062b\u0645\u0627 \u0623\u0645\u0643\u0646 \u0644\u0625\u0632\u0627\u0644\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0637\u0648\u064a\u0644\u0629 \u0627\u0644\u0623\u0645\u062f \u062a\u0645\u0627\u0645\u0627\u064b. \u064a\u062f\u0639\u0645 \u0643\u0644 \u0645\u0646 GitHub Actions \u0648GitLab CI \u0631\u0645\u0648\u0632 OIDC \u0627\u0644\u062a\u064a \u064a\u0645\u0643\u0646 \u0627\u0633\u062a\u0628\u062f\u0627\u0644\u0647\u0627 \u0628\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0645\u0632\u0648\u062f \u0633\u062d\u0627\u0628\u064a \u0642\u0635\u064a\u0631\u0629 \u0627\u0644\u0623\u0645\u062f:<\/p>\n<pre><code># GitHub Actions OIDC with AWS\njobs:\n  deploy:\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      - uses: aws-actions\/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role\/deploy-production\n          aws-region: us-east-1\n<\/code><\/pre>\n<pre><code># GitLab CI OIDC with AWS\ndeploy:\n  stage: deploy\n  id_tokens:\n    AWS_TOKEN:\n      aud: https:\/\/gitlab.com\n  script:\n    - >\n      STS_CREDENTIALS=$(aws sts assume-role-with-web-identity\n      --role-arn arn:aws:iam::123456789012:role\/deploy-production\n      --web-identity-token $AWS_TOKEN\n      --role-session-name \"gitlab-ci-${CI_JOB_ID}\")\n    - export AWS_ACCESS_KEY_ID=$(echo $STS_CREDENTIALS | jq -r '.Credentials.AccessKeyId')\n    - .\/deploy.sh\n<\/code><\/pre>\n<h2>\u062e\u0627\u062a\u0645\u0629<\/h2>\n<p>\u0644\u0643\u0644 \u0623\u0646\u0628\u0648\u0628\u0629 CI\/CD \u0646\u0645\u0648\u0630\u062c \u062b\u0642\u0629. \u0627\u0644\u0633\u0624\u0627\u0644 \u0647\u0648 \u0645\u0627 \u0625\u0630\u0627 \u0643\u0627\u0646 \u0646\u0645\u0648\u0630\u062c \u0627\u0644\u062b\u0642\u0629 \u0647\u0630\u0627 \u0642\u062f \u0635\u064f\u0645\u0645 \u0639\u0645\u062f\u0627\u064b \u0623\u0645 \u0646\u0634\u0623 \u0628\u0634\u0643\u0644 \u0639\u0631\u0636\u064a \u0645\u0646 \u0627\u0644\u0625\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0648\u0627\u0644\u062d\u0644\u0648\u0644 \u0627\u0644\u0633\u0631\u064a\u0639\u0629.<\/p>\n<p>\u064a\u062d\u062f\u062f \u0646\u0645\u0648\u0630\u062c \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0630\u064a \u062a\u062e\u062a\u0627\u0631\u0647 \u2014 \u0627\u0644\u0645\u0633\u062a\u0636\u0627\u0641 \u0639\u0628\u0631 SaaS \u0623\u0648 \u0630\u0627\u062a\u064a \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0623\u0648 \u0627\u0644\u0645\u064f\u062d\u062a\u0648\u0649 \u0623\u0648 \u0628\u062f\u0648\u0646 \u062e\u0627\u062f\u0645 \u2014 \u0627\u0644\u062e\u0635\u0627\u0626\u0635 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629 \u0644\u0623\u0646\u0628\u0648\u0628\u062a\u0643. \u0644\u0643\u0646 \u0646\u0645\u0648\u0630\u062c \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0648\u062d\u062f\u0647 \u0644\u0627 \u064a\u0643\u0641\u064a. \u064a\u062c\u0628 \u062a\u062d\u062f\u064a\u062f \u0627\u0644\u062b\u0642\u0629 \u0635\u0631\u0627\u062d\u0629\u064b \u0639\u0646\u062f \u0643\u0644 \u0627\u0646\u062a\u0642\u0627\u0644: \u0645\u0646 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0625\u0644\u0649 \u0627\u0644\u0645\u064f\u062d\u0641\u0650\u0651\u0632\u060c \u0648\u0645\u0646 \u0627\u0644\u0645\u064f\u062d\u0641\u0650\u0651\u0632 \u0625\u0644\u0649 \u0627\u0644\u062a\u0646\u0641\u064a\u0630\u060c \u0648\u0645\u0646 \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0648\u0645\u0646 \u0627\u0644\u0628\u0646\u0627\u0621 \u0625\u0644\u0649 \u0627\u0644\u0646\u0634\u0631.<\/p>\n<p>\u0627\u0644\u0623\u0646\u0645\u0627\u0637 \u0627\u0644\u0645\u064f\u063a\u0637\u0627\u0629 \u0641\u064a \u0647\u0630\u0627 \u0627\u0644\u062f\u0644\u064a\u0644 \u2014 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0646\u0628\u0648\u0628\u0629 \u0627\u0644\u0645\u0633\u0645\u0648\u0645\u0629 \u0648\u0625\u0633\u0627\u0621\u0629 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a \u0627\u0644\u0645\u0634\u062a\u0631\u0643\u0629 \u0648\u0627\u0644\u0647\u0648\u064a\u0627\u062a \u0630\u0627\u062a \u0627\u0644\u0627\u0645\u062a\u064a\u0627\u0632\u0627\u062a \u0627\u0644\u0645\u0641\u0631\u0637\u0629 \u0648\u0645\u0631\u0627\u062c\u0639 actions \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u063a\u064a\u064a\u0631 \u0648\u0647\u0648\u064a\u0627\u062a \u0627\u0644\u0628\u0646\u0627\u0621\/\u0627\u0644\u0646\u0634\u0631 \u0627\u0644\u0645\u062f\u0645\u062c\u0629 \u2014 \u0644\u064a\u0633\u062a \u0646\u0638\u0631\u064a\u0629. \u0625\u0646\u0647\u0627 \u0627\u0644\u062a\u0642\u0646\u064a\u0627\u062a \u0627\u0644\u0641\u0639\u0644\u064a\u0629 \u0627\u0644\u0645\u064f\u0633\u062a\u062e\u062f\u0645\u0629 \u0641\u064a \u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u062a\u0648\u0631\u064a\u062f \u0627\u0644\u0648\u0627\u0642\u0639\u064a\u0629\u060c \u0645\u0646 \u0627\u062e\u062a\u0631\u0627\u0642 SolarWinds \u0625\u0644\u0649 \u0627\u062e\u062a\u0631\u0627\u0642 Codecov \u0648\u0645\u0627 \u0628\u0639\u062f\u0647\u0645\u0627.<\/p>\n<p>\u0627\u0628\u062f\u0623 \u0628\u0631\u0633\u0645 \u062e\u0631\u064a\u0637\u0629 \u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629 \u0627\u0644\u062d\u0627\u0644\u064a\u0629. \u062d\u062f\u062f \u0623\u064a\u0646 \u062a\u064f\u0641\u062a\u0631\u0636 \u0627\u0644\u062b\u0642\u0629 \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646\u0647\u0627. \u062b\u0645 \u0637\u0628\u0651\u0642 \u062a\u062f\u0627\u0628\u064a\u0631 \u0627\u0644\u062a\u0642\u0648\u064a\u0629 \u0628\u0634\u0643\u0644 \u0645\u0646\u0647\u062c\u064a: \u0642\u064a\u0651\u062f \u0627\u0644\u0645\u064f\u062d\u0641\u0650\u0651\u0632\u0627\u062a\u060c \u0648\u0642\u0644\u0651\u0644 \u0627\u0644\u0623\u0630\u0648\u0646\u0627\u062a\u060c \u0648\u0627\u0639\u0632\u0644 \u0627\u0644\u0645\u064f\u0634\u063a\u0651\u0644\u0627\u062a\u060c \u0648\u062b\u0628\u0651\u062a \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a\u060c \u0648\u0627\u0641\u0635\u0644 \u0627\u0644\u0647\u0648\u064a\u0627\u062a. \u062a\u0639\u0627\u0645\u0644 \u0645\u0639 \u0623\u0646\u0628\u0648\u0628\u0629 CI\/CD \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0643 \u0628\u0646\u0641\u0633 \u0627\u0644\u0635\u0631\u0627\u0645\u0629 \u0627\u0644\u062a\u064a \u062a\u0637\u0628\u0642\u0647\u0627 \u0639\u0644\u0649 \u0628\u0646\u064a\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u2014 \u0644\u0623\u0646\u0647\u0627 \u0641\u064a \u0627\u0644\u0645\u0645\u0627\u0631\u0633\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0629 <em>\u0647\u064a<\/em> \u0627\u0644\u0628\u0627\u0628 \u0627\u0644\u0623\u0645\u0627\u0645\u064a \u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0643.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u062a\u064f\u0639\u062f\u0651 \u0623\u0646\u0627\u0628\u064a\u0628 CI\/CD \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u0645\u0643\u0648\u0646\u0627\u062a \u0627\u0645\u062a\u064a\u0627\u0632\u0627\u064b \u0641\u064a \u0623\u064a \u0645\u0624\u0633\u0633\u0629 \u0628\u0631\u0645\u062c\u064a\u0629 \u062d\u062f\u064a\u062b\u0629. \u064a\u0631\u0633\u0645 \u0647\u0630\u0627 \u0627\u0644\u062f\u0644\u064a\u0644 \u062e\u0631\u064a\u0637\u0629 \u0644\u0646\u0645\u0627\u0630\u062c \u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0645\u062e\u062a\u0644\u0641\u0629 \u0648\u062d\u062f\u0648\u062f \u0627\u0644\u062b\u0642\u0629 \u0648\u0643\u064a\u0641\u064a\u0629 \u062a\u0642\u0648\u064a\u0629 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628 \u0636\u062f \u0623\u0646\u0645\u0627\u0637 \u0627\u0644\u0647\u062c\u0648\u0645 \u0627\u0644\u0648\u0627\u0642\u0639\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u0633\u062a\u063a\u0644 \u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0627\u062a.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"post_folder":[],"class_list":["post-782","post","type-post","status-publish","format-standard","hentry","category-ci-cd-security"],"_links":{"self":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts\/782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":0,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts\/782\/revisions"}],"wp:attachment":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/media?parent=782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/categories?post=782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/tags?post=782"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/post_folder?post=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}