cicd-posture

You can assess CI/CD and supply chain posture by combining Endor findings with read-only GitHub configuration evidence and local CI file inspection to generate deterministic scores, critical overrides, and data gaps for your organization.

CI/CD and supply chain posture assessment combines Endor supply chain findings, GitHub Actions configurations, and local CI file evidence to output deterministic security scores, critical overrides, and data gaps without mutating any system state.

Yes, assessing supply chain posture requires Endor access for SCPM findings, GitHub access for configuration evidence, and local CI file access when applicable, utilizing the endorctl and github-cli dependencies to gather and evaluate evidence.

Yes, CI/CD posture assessment is strictly read-only and does not mutate any system state, safely combining Endor findings and GitHub configuration evidence to return deterministic scores, critical overrides, and data gaps.

The best way to identify supply chain data gaps is to combine Endor findings with GitHub Actions configuration evidence using this Skill, which outputs a deterministic assessment highlighting missing evidence queries, critical overrides, and security scores.

CI/CD posture assessments show missing evidence queries when there are data gaps in the combined Endor findings, GitHub configuration evidence, or local CI file inspection, indicating insufficient access permissions or missing repository configuration data.