Results for “sigstore”

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.

Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.

Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.

Google Cloud Platform SDK integration. Cloud Functions, Firestore, Cloud Storage, Pub/Sub, BigQuery, and Cloud Run. Node.js and Python client libraries. USE WHEN: user mentions "GCP", "Google Cloud", "Cloud Functions", "Firestore", "Cloud Storage", "Pub/Sub", "BigQuery", "Cloud Run", "Firebase" DO NOT USE FOR: AWS services - use `aws`; Azure services - use `azure`; Firebase Auth - use auth skills

Sets up, manages, and executes queries against Cloud Firestore database instances. You MUST unconditionally activate this skill if you plan to use Firestore in any way. Use when listing or creating Firestore databases, configuring security rules, designing data models, writing client SDK queries, or checking indexes.

Configure memorystore config operations. Auto-activating skill for GCP Skills. Triggers on: memorystore config, memorystore config Part of the GCP Skills skill category. Use when configuring systems or services. Trigger with phrases like "memorystore config", "memorystore config", "memorystore".

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Expert en infrastructure GCP (GKE, Cloud Run, BigQuery, Pub/Sub, Firestore, Cloud Functions)

Configures GKE storage including PVCs, PersistentVolumes, Filestore, and GCS FUSE with best practices for production workloads.

Provides guidance on enabling and optimizing GKE Cluster Autoscaler, including Node Auto Provisioning, troubleshooting scale-up/down issues, and best practices for capacity management.

Publish and manage Windows applications in the Microsoft Store using the msstore CLI, including credential configuration, submission management, packaging, and CI/CD integration.

Protects stateful GKE workloads by configuring backup plans, restore workflows, and disaster recovery using Backup for GKE.

Integrates Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines, configuring automated code scanning, tuning rules, uploading SARIF results, and establishing quality gates that block merges on high-severity vulnerabilities.

CI/CD pipeline setup — GitHub Actions, testing, linting, deployment. Use when setting up CI from scratch, adding GitHub Actions, automating tests, wiring up deployment, or improving an existing build pipeline.

Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation by pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection, and implementing workflow change controls.

Designs and implements CI/CD pipelines with automated testing, build automation, deployment, and rollback strategies.

Scan container images for known vulnerabilities using Anchore Grype with SBOM-based matching and configurable severity thresholds.

Design asynchronous messaging patterns in Azure using Service Bus, Event Hubs, Event Grid, and Storage Queues. Use this skill when users ask for queueing, pub-sub, event streaming, retries, or decoupled system design. Covers delivery semantics, dead-lettering, idempotency, and monitoring.

Set up CI/CD pipelines for Flutter apps. Use when configuring automated testing, build, or deployment workflows with GitHub Actions or Fastlane.

CI/CD pipeline engineering agent for GitHub Actions workflows with matrix builds, caching, artifacts, and security best practices

Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the Actions bill is high, Actions minutes, runner cost, slow CI, artifact/cache storage, or "CI/CD / workflow audit". Gate logic (bypass, ratchet gaming, required-but-not) → audit-gate-logic.