Integrates SLSA provenance generation and dependency verification across Go, Node.js, and Python toolchains.
This skill enables developers to implement Supply-chain Levels for Software Artifacts (SLSA) Level 3 provenance within their build pipelines. It provides specialized guidance for Go, Node.js, and Python projects to generate cryptographic integrity proofs for binaries, packages, and container images. By automating the integration of tools like GoReleaser, npm, and pip, the skill ensures that software artifacts are verifiable, tamper-proof, and meet modern supply chain security standards throughout the CI/CD lifecycle.
주요 기능
010 GitHub stars
02Automated SLSA Level 3 provenance generation for multiple languages
03Dependency lockfile verification for Go, npm, and Python environments
04Cryptographic attestation for container images and multi-platform builds
05Integration patterns for GitHub Actions and package registries
06Guidance for multi-artifact builds and cross-compilation workflows
사용 사례
01Securing CI/CD pipelines against supply chain attacks and unauthorized tampering
02Automating package integrity verification during the build and release process
03Meeting regulatory and compliance requirements for software artifact traceability
