Glossary
GitHub & CI/CD glossary
Plain-language definitions of the terms behind operating GitHub Actions at scale, from control planes and continuous compliance to CargoWall, OIDC, and CI/CD migration.
- CargoWall
- CodeCargo's eBPF kernel-level network egress firewall for GitHub Actions runners, with per-workflow, per-repository, and organization-wide allow-lists and DNS interception to block data exfiltration at runtime, before a connection is established.
- Chargeback
- Attributing the cost of shared infrastructure, here GitHub Actions compute, back to the team that incurred it, so spend is visible and controllable.
- CI/CD pipeline
- The automated sequence that builds, tests, and deploys software when code changes. Jenkins and GitHub Actions are two systems for defining and running pipelines.
- Compliance score
- A 0-to-100 rating CodeCargo assigns each GitHub Actions workflow against a policy rule set, tracked over time to show whether workflows are becoming more or less compliant.
- Continuous compliance
- Re-evaluating every workflow against policy on an ongoing basis and surfacing drift, rather than proving compliance once at a single point in time.
- Control plane
- A layer that centrally administers, governs, and proves the state of a large system. For CodeCargo, the system is an enterprise GitHub estate operated at scale.
- Developer self-service
- Letting developers provision and run compliant pipelines and resources on their own, within guardrails, without filing tickets to a central platform team.
- Drift
- When a workflow that was compliant at one point falls out of policy over time. Continuous compliance detects and surfaces drift the moment it appears.
- eBPF
- A Linux kernel technology that runs sandboxed programs in kernel space. CargoWall uses eBPF to enforce network egress policy on a runner with microsecond-level latency.
- Egress firewall
- A control that governs the outbound network connections a workflow job is allowed to make. A runner egress firewall blocks exfiltration before the connection opens, which pre-run scanning cannot do.
- GitHub Actions Importer
- GitHub's free, Docker-based tool (run via gh actions-importer) that audits, forecasts, dry-runs, and migrates pipelines from Jenkins, Azure DevOps, GitLab, CircleCI, and others into GitHub Actions.
- GitHub Actions workflow
- A YAML-defined automation in GitHub Actions, made up of one or more jobs, each containing steps, triggered by repository events.
- GitHub-native
- Built specifically around GitHub and GitHub Actions rather than being platform-agnostic, so it integrates with and extends GitHub's own primitives and operates Actions directly.
- Golden-path pipeline
- A reusable, pre-approved CI/CD workflow template that is secure and compliant by default, giving developers a paved road instead of building pipelines from scratch.
- Internal Developer Platform (IDP)
- A self-service layer that gives developers paved-road access to infrastructure, pipelines, and services within guardrails.
- OIDC (OpenID Connect)
- An identity protocol GitHub Actions uses to obtain short-lived cloud credentials at run time, removing the need to store long-lived secrets in a repository.
- Policy as code
- Expressing security and governance rules in a machine-readable form so they can be evaluated and enforced automatically, for example with Open Policy Agent or Kyverno.
- Reusable workflow
- A GitHub Actions workflow that other workflows call, so shared logic is defined once instead of copied into every pipeline. A key target for consolidating a large migrated estate.
- Runtime security
- Detecting and responding to threats while a CI/CD job is actually executing, as opposed to scanning code or configuration before the job runs.
- Service connection
- In Azure DevOps, a stored credential or endpoint a pipeline uses to reach an external system. These are re-mapped by hand during migration rather than auto-copied, for security reasons.
- SHA-pinning
- Referencing a GitHub Action by its full commit SHA instead of a mutable tag, so the code that runs cannot change underneath you.
- SOC 2 Type II
- An independent audit of how an organization operates its security controls over a period of time, not just at a single moment. CodeCargo holds this certification.
- Supply-chain integrity
- Securing the components a workflow depends on, actions, dependencies, and credentials, so a compromised or mutable dependency cannot subvert the pipeline.
Operate GitHub Actions at scale
CodeCargo is the control plane for GitHub: administration, CI/CD migration, compliance, and runtime security, all on top of GitHub.