skills.rest
spencerbeggs
spencerbeggsCOMMUNITY
Explore all skills by this author →
GitHub

supply-chain-attestation

Generate, sign, and upload CycloneDX SBOMs and SLSA provenance predicates.

2|Updated Jul 2, 2026
Search Tags:#security#supply-chain#github-actions#sbom#attestation#sigstore
One-click install
npx skills add https://github.com/spencerbeggs/effected --skill supply-chain-attestation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-attestation
Source: https://github.com/spencerbeggs/effected/tree/main/plugin/skills/supply-chain-attestation
Command: npx skills add https://github.com/spencerbeggs/effected --skill supply-chain-attestation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the complexity of generating verifiable supply-chain attestations, ensuring that software artifacts are transparent, compliant with NTIA standards, and cryptographically signed for integrity.

Core Features & Use Cases

  • SBOM Generation: Create CycloneDX SBOMs with validated metadata and dependency relationships.
  • Cryptographic Signing: Sign attestations using Sigstore, integrating OIDC tokens from GitHub Actions for secure workload identity.
  • Compliance & Provenance: Generate SLSA provenance predicates and verify NTIA minimum elements to ensure build integrity.

Quick Start

Use the supply-chain-attestation skill to generate an SBOM for the current package and sign it using the GitHub Actions OIDC identity.

Frequently Asked Questions about supply-chain-attestation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a CycloneDX SBOM and sign it using GitHub Actions OIDC?▼

You generate a CycloneDX SBOM and sign it by integrating Sigstore, which uses GitHub Actions OIDC tokens for secure workload identity to cryptographically sign the supply-chain attestation.

What is SLSA provenance and when do I need it for software artifacts?▼

SLSA provenance is a verifiable record of how a software artifact was built. You need SLSA provenance to establish build integrity and satisfy requirements for verifiable build provenance in secure supply-chain pipelines.

Does this skill support NTIA minimum elements for compliance checks?▼

Yes, this skill verifies NTIA minimum elements for software transparency. It generates attestations that satisfy NTIA compliance standards, ensuring your software artifacts meet the required baseline for secure supply-chain practices.

Can I use Sigstore integration in my CI/CD pipelines without storing secrets?▼

Yes, you can use Sigstore integration without storing secrets by leveraging GitHub Actions OIDC authentication. This approach provides secure workload identity through short-lived tokens, eliminating the need to manage long-term cryptographic keys.

What's the best way to automate end-to-end supply-chain attestation for builds?▼

The best way to automate end-to-end supply-chain attestation is to integrate this skill into your CI/CD pipelines. It handles generating, signing, and uploading attestations including SBOMs and SLSA provenance predicates automatically.

Related Skills

Explore More Software Engineering Skills→
spallempatispallempati

devops-ci-cd

Enforces CI/CD pipeline standards for GitHub Actions and Azure Pipelines.

Community
Intermediate
asalhamedasalhamed

supply-chain-security-agent

Generate SBOMs, sign artifacts, and record provenance for software and firmware releases.

Community
Advanced
patricio0312revpatricio0312rev
5

artifact-sbom-publisher

Generate SBOMs and publish artifacts with provenance metadata in CI/CD pipelines.

Community
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced