Results for “source-verification”

Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.

Runs a multi-phase verification pipeline including build, type-check, lint, tests, security scan, and diff review to ensure code quality before creating a PR.

Scaffolds a per-task verification skill for a repo, including a dev-local launcher, a browser driver, and a verification SOP that spawns a sub-agent to drive the app and produce proof.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.