skills.rest
vesviet
vesvietCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-security

Generates SBOMs, SLSA provenance, artifact signatures, and VEX documents for CI/CD pipelines.

Updated Feb 10, 2026
Search Tags:#ci/cd#supply chain security#slsa#sbom#cyclonedx#sigstore#vex
One-click install
npx skills add https://github.com/vesviet/agent-skills --skill supply-chain-security-vesviet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-security
Source: https://github.com/vesviet/agent-skills/tree/main/core/skills/platform/supply-chain-security
Command: npx skills add https://github.com/vesviet/agent-skills --skill supply-chain-security-vesviet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Modern builds pull in hundreds of third-party dependencies, MCP servers, and AI-generated code, making it hard to know what is inside a release artifact or whether it was tampered with. This Skill operationalizes supply chain security so every production artifact ships with an inventory, provenance, and a signature. ## Core Features & Use Cases - SBOM Generation: Produce CycloneDX or SPDX bills of materials at build time and store them alongside artifacts, including MCP server dependencies with publisher provenance. - SLSA Provenance & Signing: Generate SLSA Level 2/3 provenance via slsa-github-generator and sign artifacts and SBOMs with Sigstore/cosign before release. - VEX & Continuous Monitoring: Publish VEX documents declaring non-exploitable CVEs and feed SBOMs into Dependency-Track or SCA tooling for ongoing alerts. - Use Case: A platform team hardening a GitHub Actions pipeline uses this Skill to add per-build CycloneDX SBOMs, cosign-signed container images, and a release gate that rejects unsigned artifacts. ## Quick Start Use the supply-chain-security skill to add SBOM generation, SLSA provenance, and cosign signing to my CI pipeline.

Frequently Asked Questions about supply-chain-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an SBOM in a CI/CD pipeline?▼

Generate an SBOM at build time using a CycloneDX or SPDX generator step in your CI workflow, then store it alongside the build artifact in the registry. Include version, license, hash, and source commit for every component.

CycloneDX vs SPDX: which SBOM format should I use?▼

CycloneDX fits DevSecOps pipelines, vulnerability management, and VEX support, while SPDX suits legal review and license compliance workflows. Mature organizations often produce both to cover security and legal requirements.

How do I achieve SLSA Level 2 or 3 provenance with GitHub Actions?▼

Use the slsa-framework/slsa-github-generator reusable workflow to produce signed provenance for your build outputs. For Level 3, pin GitHub Actions to full 40-character commit SHAs and use hardened, hermetic build environments.

What is a VEX document and when do I need one?▼

A VEX (Vulnerability Exploitability eXchange) document declares which known CVEs are not exploitable in your deployment context, with justification such as code_not_reachable. Publish one alongside every SBOM so scanners do not flag non-exploitable findings.

Does this approach cover MCP server dependencies?▼

Yes. Every MCP server dependency is treated as a supply-chain artifact: it must appear in the SBOM with publisher identity verification, behavioral analysis, and version pinning, and its SBOM is reviewed on every registry update.

Why do SBOMs become stale after release?▼

A static SBOM snapshot cannot reflect newly disclosed CVEs affecting listed components. Feed SBOMs into continuous monitoring tools like Dependency-Track and regenerate them in CI on every build to prevent drift.

Related Skills

Explore More Software Engineering Skills→
cornmanwtfcornmanwtf

supply-chain-security

Generate SBOMs, verify third-party dependencies, and sign build artifacts.

Community
Advanced
brucebanner010198-commitsbrucebanner010198-commits

sbom-slsa

Generates CycloneDX SBOMs and SLSA provenance for released artifacts.

Community
Advanced
BryantChiBryantChi
9

Supply Chain Security

Implement dependency governance and integrate SCA scans into CI pipelines.

Community
Advanced
haomingzhaomingz
12

glab-attestation

Verify software artifact attestations using glab and cosign in GitLab CI pipelines.

Community
Intermediate