The Build-Deploy Gap

▶ Watch (00:53)

Build on Monday, deploy on Wednesday. Anything can change in between: a new CVE drops, someone swaps an artifact, a dependency gets patched. Without an automated answer to “is this still safe?”, every deployment is a trust exercise with no evidence behind it.

Walker framed the whole demo around that gap. RBAC and audit logs matter, but they don’t tell you whether the thing you built 48 hours ago has been manipulated or is now exposed. The pipeline has to answer that automatically, every time, before the deploy button does anything.

GitHub Actions: Scan, Sign, and Hand Off

▶ Watch (02:45)

The GitHub Actions workflow does five things before Octopus ever sees the artifact: unit tests, repo vulnerability scan, Docker image scan, SBOM generation, and attestation signing. The last three steps are the ones that matter for supply-chain integrity. Build, scan, publish the image. Generate the SBOM. Generate the attestation. Then hand off.

“developers, they don’t read logs.” — Bob Walker

That observation is why the attestation exists. A human won’t catch a tampered artifact in a task log. A cryptographic signature will.

Octopus Deploy: Verify Attestation and Scale Security

▶ Watch (05:06)

At deploy time, Octopus attaches the SBOM to the release, calls gh attestation verify, and checks GitHub for open vulnerabilities. That’s three gates before a single container starts. The real force multiplier is the template system. Walker templatized the attestation check, the SBOM attachment, and the Kubernetes deploy step. When he added the open-vulnerability check later, it went out as a minor-version update to every application automatically.

“I’m solving it for 1000 applications.” — Bob Walker

Compliance policies add a second layer. They require a specific template version and either block non-compliant deployments or give teams 30 days to upgrade before the block kicks in.

AI-Assisted Remediation via MCP

▶ Watch (10:16)

Walker deliberately tampered with an artifact to trigger an attestation failure, then switched to Visual Studio Code and asked GitHub Copilot to diagnose it. Copilot called the attestation failure and Copilot remediation demo (10:16) via the Octopus Deploy MCP server, read the task log, named the failed step, reported the error code, and returned a list of self-service remediation steps including how to regenerate and publish the attestation.

The goal isn’t gatekeeping. It’s cutting the time between “something broke” and “developer knows exactly what to fix” to near zero.

Notable Quotes

developers, they don’t read logs. Bob Walker · ▶ 2:29

I’m solving it for 1000 applications. Bob Walker · ▶ 7:58

I’m able to push that out in a very low friction way. Bob Walker · ▶ 8:00

Key Takeaways

  • Generate and verify an SBOM and attestation on every build to catch supply-chain tampering before it reaches production.
  • Templatize deployment steps once in Octopus and push vulnerability checks to 1000 applications with a single minor-version update.
  • GitHub Copilot and the Octopus MCP server turn a raw task log into a self-service remediation checklist without a human triage step.