What problem does it solve? Modern attacks target the build and release pipeline rather than application code: force-moved action tags, malicious npm install scripts, and unsigned artifacts. This Skill gives a structured, evidence-based method to harden a repository's entire software supply chain, from GitHub Actions workflows to SBOMs, signing, and compliance obligations. ## Core Features & Use Cases - CI/CD Hardening: Runs zizmor and actionlint against workflows, pins actions to commit SHAs with pinact, enforces least-privilege permissions, and blocks dangerous pull_request_target patterns. - Dependency Intake Policy: Applies deterministic-versus-soft-signal disposition rules for vulnerable, malicious, abandoned, or newly published packages, with lockfile discipline and release cooldowns. - Provenance and Compliance: Generates CycloneDX SBOMs with syft, signs artifacts with cosign keyless mode, produces SLSA build provenance, and maps controls to OpenSSF Scorecard, OSPS Baseline, EU CRA, NIST SSDF, and OWASP ASVS. - Use Case: Point it at a repository before a release to get a tiered security profile, SHA-pinned workflows, a validated Action Bill of Materials, and a findings report with file:line evidence for every issue. ## Quick Start Review this repository's supply chain security, starting with the GitHub Actions workflows, and produce a tiered findings report with an SBOM and pinned action references.
