Compare & Checklist

Concept map

The same idea under three names. Use this when you know how to do something on one platform and need the equivalent on another.

Concept	GitHub Actions	Azure DevOps	GitLab CI/CD
Pipeline file	`.github/workflows/*.yml`	`azure-pipelines.yml` (any path)	`.gitlab-ci.yml`
Structure	workflow › job › step	pipeline › stage › job › step	pipeline › stage › job › script
Compute	Runner: GitHub-hosted or self-hosted	Agent: Microsoft-hosted, Managed DevOps Pools, self-hosted	Runner: GitLab-hosted or self-managed
Reuse	Reusable workflows, composite actions	Templates with `template` and `extends`	`include`, CI/CD components, `extends`
Central enforcement	Org rulesets that require workflows	Required template check on protected resources	Scan execution, approval and pipeline execution policies
Built-in token	`GITHUB_TOKEN`, scoped by `permissions`	`System.AccessToken`, scoped by job authorization scope	`CI_JOB_TOKEN`, scoped by the job token allowlist
OIDC to cloud	`permissions: id-token: write`	Service connection with workload identity federation	`id_tokens:` with `aud`
Secrets	Repository, organization and environment secrets	Secret variables, Key Vault-linked variable groups, secure files	Protected, masked and hidden CI/CD variables; Vault via `secrets:`
Deployment gate	Environments: required reviewers, branch rules, wait timer	Environments: approvals and checks	Protected environments: deployment approvals
Serialize deploys	`concurrency`	Exclusive lock check, `lockBehavior`	`resource_group`
Fork contributions	`pull_request` with read-only token, approval for outside contributors	Fork builds without secrets, comment to trigger	Fork MR pipelines run in the fork
Injection trap	`${{ }}` inside `run`	`$(macro)` inside `script`	Re-parsing with `sh -c` or `eval`
Pinning	Actions by full commit SHA, enforceable by policy	Template repositories by `ref` tag; images by digest	Includes by `ref`; components by exact version

Security features side by side

What each platform gives you natively, and what it costs. GitHub and Azure DevOps both sell Secret Protection and Code Security as separate products; on GitHub they are free for public repositories.

Capability	GitHub	Azure DevOps	GitLab
Secret scanning	Secret Protection, with push protection	Secret Protection, with push protection (Azure Repos only)	Secret Detection job (Free); secret push protection (Ultimate)
SAST	CodeQL via Code Security	CodeQL tasks via Code Security	SAST template (Free); Advanced SAST (Ultimate)
Dependency scanning	Dependency review and Dependabot	Dependency scanning task (Code Security)	Dependency Scanning v2 (Ultimate)
IaC and containers	Third-party scanners, results via SARIF	Third-party scanners, results via the Publish task	SAST-IaC and Container Scanning templates (Free)
Merge gate on findings	Ruleset: require code scanning results	Branch policy build validation; scanner exit codes	Merge request approval policy (Ultimate)
Signing and provenance	Artifact attestations: SLSA provenance and SBOM	Notation with Azure Key Vault	Sigstore keyless signing with `id_tokens`
Pipeline lint	CodeQL `actions` language	Third-party (poutine)	Third-party (poutine)

Hardening checklist

Thirty-two controls, grouped the same way as the tutorials. Choose a platform to see only its instructions.

Progress0 of 32

Source control 0/5

The default branch only changes through a reviewed pull or merge request. GitHubRuleset: require a pull request with at least one approval. ADOBranch policy: minimum number of reviewers. GitLabProtected branch: push allowed for no one; MR approvals required.
Authors cannot approve their own change, and new commits reset approvals. GitHubDismiss stale approvals; require approval of the most recent push. ADOProhibit the most recent pusher from approving; reset votes on push. GitLabPrevent author approval; remove approvals when commits are added.
Pipeline files and scanner exceptions have code owners from the platform or security team. GitHubCODEOWNERS on /.github/workflows/; require Code Owner review. ADOAutomatically included required reviewers on the pipeline file path. GitLabCODEOWNERS section for .gitlab-ci.yml; code owner approval on main.
Force pushes and deletion of the default branch are blocked. GitHubRuleset: block force pushes, restrict deletions. ADOBranch security: deny Force push and Remove others' locks for contributors. GitLabProtected branch: "Allowed to force push" off.
Secret push protection blocks credentials before they enter the repository. GitHubSettings › Advanced Security › Push protection. ADORepository settings › Advanced Security › Push protection. GitLabSecure › Security configuration › Secret push protection (Ultimate).

Identity and secrets 0/5

No long-lived cloud credentials are stored; deploys authenticate with OIDC. GitHubid-token: write with azure/login, AWS or GCP equivalents. ADOService connections using workload identity federation. GitLabid_tokens: with an audience per destination.
The production identity trusts one repository plus a protected environment or branch, never a wildcard. GitHubSubject repo:org/repo:environment:production. ADOA dedicated production service connection with branch control. GitLabSubject names the project and the protected main branch.
The default job token is read-only or project-scoped; jobs request extra access explicitly. GitHubRead-only default; permissions: {} at the top of each workflow. ADOLimit job authorization scope to the current project. GitLabJob token allowlist limited to this project; fine-grained permissions.
Remaining secrets are scoped to environments or protected refs and reach only the steps that use them. GitHubEnvironment secrets; pass to steps through env; avoid secrets: inherit. ADOKey Vault-linked variable groups as protected resources; map into env. GitLabProtected, masked and hidden variables with environment scope.
Debug logging is never enabled on jobs that hold secrets. GitHubRestrict who can re-run with debug logging; review ACTIONS_STEP_DEBUG use. ADODo not set system.debug as settable at queue time. GitLabAvoid CI_DEBUG_TRACE; it can reveal masked values.

Pipeline definition 0/5

Every third-party action, task, template and image is pinned to an immutable reference. GitHubFull commit SHAs; turn on the SHA pinning policy. ADOTemplate repositories by tag in ref; container images by digest. GitLabinclude with ref; components at exact versions; images by digest.
Only reviewed actions, tasks or extensions are allowed to run. GitHubAllowed actions policy with an explicit list; block known-bad versions with !. ADOReview Marketplace extensions; allowlist tasks in the required template. GitLabUse components from your own catalog; review external includes.
Untrusted values (titles, branch names, commit messages) reach scripts only through environment variables. GitHubNo ${{ github.event.* }} inside run; lint with CodeQL or zizmor. ADONo $(System.PullRequest.*) macros inside script. GitLabQuote variables; never pass them through sh -c or eval.
Code from forks runs without secrets or write tokens, and only after approval. GitHubUse pull_request, not pull_request_target; require approval for outside contributors. ADOSecrets off for fork builds; require a team member's comment. GitLabKeep fork MR pipelines in the fork until the change is reviewed.
Security stages come from a central definition that application teams cannot remove. GitHubReusable workflow plus an org ruleset that requires it. ADOextends template plus the required template check. GitLabScan execution or pipeline execution policies.

Security gates 0/6

Secret scanning runs on every push, with a scheduled full-history scan. GitHubSecret Protection covers history automatically. ADOSecret Protection scans the repository including history. GitLabSecret Detection job; schedule a historic scan.
SAST blocks merges that add critical or high findings. GitHubCodeQL plus "Require code scanning results" in the ruleset. ADOCodeQL tasks; or Semgrep with --error as a required build. GitLabSAST template plus an approval policy, or a blocking Semgrep job.
Dependency scanning blocks new critical or high CVEs that have a fix, and enforces a license list. GitHubdependency-review-action with fail-on-severity and allow-licenses. ADODependency scanning task, or OSV-Scanner as a blocking step. GitLabDependency Scanning v2 with an approval policy, or Trivy fs as a gate.
Infrastructure-as-code is scanned on every pull request. GitHubTrivy config scan uploaded as SARIF. ADOTrivy config scan published with AdvancedSecurity-Publish@1. GitLabSAST-IaC template.
Container images are scanned and a fixable critical or high CVE stops the release. GitHubTrivy image scan with exit-code: "1" before attestation. ADOTrivy image scan before Docker@2 push. GitLabimage-gate job before the sign stage.
Every exception has an owner, a reason and an expiry date, and code owners review it. GitHubDismissal reasons in code scanning; .trivyignore.yaml with expired_at. ADOAlert dismissal with reason; ignore files under required reviewers. GitLabVulnerability dismissal reasons; ignore files in CODEOWNERS.

Artifact integrity and deployment 0/6

Each artifact is built once and referred to by digest from then on. GitHubPass steps.push.outputs.digest to later jobs. ADOOutput variable from a resolve step; stageDependencies. GitLabDotenv report carrying IMAGE_DIGEST.
An SBOM is generated from the built artifact and stored with it. GitHubSyft via anchore/sbom-action, attested with actions/attest. ADOSyft or Microsoft sbom-tool; publish as an artifact or attach with ORAS. GitLabCycloneDX reports from Container Scanning and Dependency Scanning.
Artifacts are signed or attested by the pipeline. GitHubArtifact attestations (Enterprise Cloud for private repos) or cosign keyless. ADONotation with a Key Vault key. GitLabcosign keyless with SIGSTORE_ID_TOKEN.
Deploys verify the signature or provenance, and the expected signer, before running. GitHubgh attestation verify with --signer-workflow. ADONotation@0 verify with a trust policy from the platform repo. GitLabcosign verify with --certificate-identity.
Production deploys need approval from someone other than the author. GitHubEnvironment required reviewers with "Prevent self-review". ADOApprovals check; disallow approving your own run. GitLabProtected environment with required approvals (Premium).
Deployments to one environment are serialized. GitHubconcurrency group with cancel-in-progress: false. ADOExclusive lock check with lockBehavior: sequential. GitLabresource_group: production.

Runners and operations 0/5

Runners or agents are ephemeral: a fresh machine or container for every job. GitHubGitHub-hosted, or just-in-time self-hosted runners and ARC. ADOMicrosoft-hosted, Managed DevOps Pools, or scale set agents that tear down VMs. GitLabAutoscaling runners or the Kubernetes executor.
Privileged or production-capable runners only take jobs from protected refs. GitHubRunner groups limited to selected repositories and workflows. ADOAgent pool as a protected resource with branch control. GitLabRegister the runner as "Protected" and target it with tags.
Scheduled rescans catch new CVEs in code that has not changed. GitHubschedule: trigger on the CI workflow; Dependabot alerts. ADOschedules: with always: true on the default branch. GitLabPipeline schedule, or a scheduled scan execution policy.
Dependency and pin updates are automated, with a short cooldown for new releases. GitHubDependabot with cooldown, including the github-actions ecosystem. ADORenovate with minimumReleaseAge. GitLabRenovate with minimumReleaseAge.
Audit logs for pipeline, permission and environment changes go to your SIEM. GitHubEnterprise audit log streaming. ADOAudit streams to Azure Monitor or Splunk. GitLabAudit event streaming (Ultimate).