Google Cloud Secure Source Manager Adds New Capabilities for CI/CD Pipeline Security

Enhanced CI/CD Security Features

Google Cloud Secure Source Manager (SSM) has released two new capabilities, now generally available, designed to strengthen the security of CI/CD pipelines. These features address critical vulnerabilities in the software supply chain, particularly concerning unauthorized access and code modifications.

Blocking Unauthorized CI/CD Access

One new capability allows SSM to block unauthorized access to CI/CD systems. This protection extends from the version control system to build, artifact, and deployment tools, mitigating risks even if a corporate network is compromised. This feature aims to prevent attackers from altering deployment scripts and injecting malware into the CI/CD pipeline.

Granular Code Ownership and Access Control

The second new feature is the Code Owners system, which provides more granular identity and access management (IAM) by managing pull request approver sets at a per-file and per-branch level. This system adds safeguards to files and directories within a repository, helping to prevent unauthorized changes by authorized users.

Key aspects of the Code Owners system include per-path approver sets using glob-style path specifiers, branch-specific governance to define different owners for various branches, and nestable CODEOWNERS files in sub-directories, allowing sub-teams to manage their specific folders.

Addressing Software Supply Chain Threats

These updates come in response to an increase in software supply chain attacks, which more than doubled in the first half of 2026 compared to the second half of 2025. By providing unified authentication and authorization mechanisms, SSM aims to help organizations better address these threats and secure their source code and CI/CD systems.