US federal agencies (cisagov, GSA, NIST, and 300+ other orgs) publish open-source code on GitHub, but their CI/CD pipelines carry the same vulnerability patterns as everyone else: unpinned actions, overly broad tokens, and pwn-request triggers. Executive Order 14028 and the CISA SSDF set the mandate, but the gap between policy and workflow-level implementation is wide.

This talk covers what I found auditing federal repositories for CI/CD weaknesses, and the process of turning findings into accepted contributions. I share before-and-after examples, explain why least-privilege permissions matter even for public repos, and discuss practical challenges: review timelines, CLA processes, and framing a PR so it gets merged.

Over 320 merged security contributions across 75 organizations, with accepted fixes in NASA, NIST, and other federal agencies, plus private vulnerability disclosures to government repositories.