Evaluating supply chain security risks in CI/CD-pipelines - a study on mutable github actions and transitive dependences

Abstract

This bachelor thesis investigates supply chain security risks in GitHub Actions-based CI/CD environments, with a critical focus on the often-overlooked dangers of mutable and transitive dependencies. While modern automated workflows rely heavily on thirdparty code, the lack of strict governance and native lockfile mechanisms in GitHub Actions creates significant blind spots. To address this, the thesis introduces the Mutable Dependency Risk Score (MDRS) model, a structured analytical framework designed to identify and quantify high-risk dependency patterns. The theoretical model is being put into practice through the development of the MDRS Checker, a software tool capable of performing recursive dependency resolution across multiple ecosystems. By applying the tool to real-world case studies, including a simulated environment of the devastating ua-parser-js supply chain attack, the evaluation demonstrates the models efficacy. The results show that the implementation of a severity override mechanism successfully surfaces deeply hidden transitive risks. Ultimately, this thesis provides software engineering teams with both the theoretical understanding and the practical tooling necessary to expose invisible weaknesses and strategically prioritize their mitigation efforts.