Results for “software-supply-chain”

Sign build artifacts (binaries, packages, containers) with GPG, Sigstore, and platform-specific tools to ensure integrity and authenticity throughout the software supply chain.

Generate CycloneDX and SPDX SBOMs from container images and filesystems, scan them for vulnerabilities with Grype, and sign attestations with Cosign for supply-chain trust.

Verify container image integrity across CI/CD pipelines using the in-toto framework to generate and check cryptographically signed attestations.

Build and release pipeline for the Pump SDK — tsup TypeScript builds, Cargo release profiles, semantic release with commitizen, npm publishing, linting, Makefile targets, Vercel deployment, and MCP server distribution.

Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Composite skill — safely refactor a module end-to-end with sequencing, parallel implementation, post-refactor cleanup, and rationale capture. Chains refactor-plan (phased plan + rollback) → three-man-team (architect/builder/reviewer in parallel) → fix-the-suite post-refactor → adr-write → docs-sync. Use for non-trivial refactors that need both careful sequencing and durable record.

Automates the collection of suspicious files from endpoints and email gateways, submission to sandbox and multi-engine scanners, and generation of verdicts with IOCs for SIEM integration.

Set up a continuous integration and continuous delivery (CI/CD) pipeline for a software project, automating builds, tests, and deployments across environments. Use when the user requests ci cd or provides relevant inputs for this workflow.

Identify, test, deploy, and verify software updates across an organization's IT infrastructure using a structured patch management workflow with phased rollouts and automated assessment.

Automates multi-language software builds with Makefiles, dependency management, testing, packaging, and CI/CD integration.

Coordinate staged releases across Stripe, Supabase, and Vercel from the shell using the Composio CLI. One script kicks off the whole 'ship it' sequence: product/price updates, DB migrations, frontend deploy, smoke checks, changelog post.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Runs a five-phase pipeline—evaluation, specification, implementation, review, and QA—to build a feature end-to-end with specialized agents.

Full daily sales pipeline execution. Run at 9 AM via cron. Scans for signals, enriches company leads, auto-applies to gigs, runs multi-channel outreach, processes follow-ups. All delivery automated via Chrome DevTools MCP.

Full release pipeline — tests → coverage → review gate → version bump → CHANGELOG → commit → PR

Signs and verifies software artifacts using Sigstore's keyless signing, Rekor transparency log, and Fulcio certificate authority, integrating into CI/CD pipelines and Kubernetes admission controls.