Supply Chain Review
Review how code and dependencies enter the build.
Workflow
- Inspect package manifests, lockfiles, CI workflows, release scripts, and build/publish configuration.
- Identify install-time execution, unpinned sources, registry drift, generated artifacts, and privileged tokens.
- Check whether changes widen permissions or provenance risk.
- Recommend minimal hardening and validation.
Output
- supply-chain surfaces
- risky changes or defaults
- affected workflow
- evidence
- remediation
- validation gaps
Rule
Do not upgrade or rewrite the build unless the user asks for implementation. Review first, then patch only when scoped.