cicd-golden-pipeline

To generate OSCAL artifacts and SBOMs in a GitHub Actions CI/CD pipeline, use a reusable workflow_call that enforces SSDF-aligned checks and orchestrates federated evidence verification across pushes and PRs, producing machine-readable outputs.

Aligning GitHub Actions workflows with SSDF and EO 14028 compliance requirements involves implementing a centralized, policy-driven pipeline design that enforces structured audit events and reproducible evidence bundles for modern risk management.

Yes, you can enforce per-repo IAM roles and evidence verification across multiple GitHub Actions repositories by copying a centralized, policy-driven pipeline into each repo to ensure consistent security and provenance.

Yes, this compliant pipeline approach supports risk management reviews by generating machine-readable evidence and OSCAL outputs that satisfy structured audit event requirements and functional compliance checks.

To set up a reusable GitHub Actions workflow for federated compliance checks, copy the skill into your repository and reference the reusable workflow in your GitHub Actions configuration to start enforcing a compliant pipeline.

Reproducible evidence bundles and structured audit events in CI/CD are needed to satisfy functional compliance requirements, supporting modern risk management reviews with machine-readable OSCAL outputs and provenance verification.