Implementing a Secure CI/CD Pipeline for Verifiable Trust in a Federated Health Data Network

Software supply chain attacks threaten the trust essential for Federated Health Data Networks. We designed and evaluated a secure CI/CD pipeline for the German AKTIN Data Warehouse. The pipeline generates signatures, SBOMs, and provenance attestations, enabling participants to independently verify software integrity. An initial baseline assessment successfully produced these artifacts and identified 264 high-severity vulnerabilities, primarily from legacy components. The approach provides a transferable model for establishing verifiable trust and strengthening security in federated health infrastructures.