# Supply Chain Hygiene

> Use when adding/updating dependencies, build pipelines, packaging, containers, or releases. GitHub Actions focused. Aim for SBOM + provenance + scanning with least privilege.

- Skill: `askaret/supply-chain-hygiene` (Agent Skill)
- Install (CLI): `npx skillmds@latest add askaret/supply-chain-hygiene`
- Raw SKILL.md: https://api.skillmd.com/api/skills/askaret/supply-chain-hygiene/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: askaret (https://skillmd.com/u/askaret)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/askaret/supply-chain-hygiene

---


Principles:
- Prefer short-lived, federated auth (OIDC) over long-lived secrets.
- Least-privilege workflow permissions and environment protections.
- Produce verifiable artifacts: SBOM + build provenance + (optional) signatures.

Checklist (GitHub Actions):
1) Dependency controls
- Ensure Dependabot is enabled (deps + GitHub Actions versions)
- Add dependency review on PRs (block known vulnerable/forbidden licenses where required)
- Add/verify CodeQL code scanning for relevant languages
- Enable secret scanning + push protection where available/allowed

2) Workflow hardening
- Pin third-party actions to commit SHA (or organization-approved policy)
- Default GITHUB_TOKEN permissions to read-only; elevate per job only when required
- Avoid dangerous patterns:
  - untrusted code in privileged workflows
  - unsafe `pull_request_target` usage
  - downloading/using artifacts without verification
- Prefer reusable workflows for shared hardening patterns

3) Provenance & SBOM
- Generate SBOM for release artifacts (CycloneDX or SPDX format)
- Generate build provenance attestation for produced artifacts
- Publish SBOM and attestation alongside the artifact (release assets or artifact store)
- Document how to verify provenance/SBOM for consumers

4) Signing (optional but recommended for high-risk artifacts)
- Sign container images or packages (Sigstore/cosign or org standard)
- Store verification policy/runbook

Finish with:
- What was added/enabled (Dependency Review, CodeQL, secret scanning, SBOM, provenance)
- Where artifacts are published (SBOM + attestation)
- How to verify (commands/steps)
- Remaining gaps/todos