# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-CI-004
title: Separate dependency caches by trust level
finding:
  title: Untrusted builds can write to caches used by trusted builds
status: draft
profiles: [baseline]
risk:
  severity: medium
assessment: partial
tags: [ci, cache]
description: |
  Dependency caches are keyed on the lockfile hash. Builds of untrusted changes (external contributions, forks) cannot write to caches read by default-branch or release builds.
rationale: |
  A poisoned cache lets an attacker who can run one build insert packages into every following build, bypassing lockfile and registry controls.
impact: |
  Slightly lower cache hit rates.
audit:
  manual: |
    1. Review cache configuration of pipelines.
    2. Check cache keys include the lockfile hash and that untrusted builds cannot write to trusted caches.
  checks:
    - id: postmortem
      engine: postmortem
      description: "GitHub Actions cache keys and pull_request_target; other CI by hand"
      spec:
        command: postmortem harden --json
        control: CB-DEP-CI-004
        coverage: partial
remediation:
  manual: |
    1. Key caches on the lockfile hash.
    2. Give untrusted builds read-only or separate caches.
references:
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SI-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1195.001
related_controls:
  - id: CB-DEP-LOCK-003
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16