Results for “source-validation”

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.

Runs a two-wave validation pipeline (deterministic checks then rule-based checks) before every git commit, writing a sentinel file that a pre-commit hook enforces. Includes optional quick mode (first wave only) and a fix loop with up to three iterations.