What problem does it solve? Container images that run as root and devcontainer configurations with floating image tags or partially pinned features create security and reproducibility gaps that nothing on disk reveals. This Skill deploys the BLD-001 (non-root container user) and DEV-001 (version-pinned devcontainer) controls into a repository and wires enforcement at pre-commit and CI loci. ## Core Features & Use Cases - Non-root container enforcement: Stamps or writes a remoteUser in devcontainer.json so the container never silently runs as root, and stops when a Dockerfile's final stage ends as root. - Digest pinning: Resolves floating image tags to @sha256: digests and regenerates devcontainer-lock.json so every declared feature is pinned, catching partial-lock half-states. - Locus wiring with provenance stamps: Writes a pre-commit hook and CI step carrying per-control stamps, then verifies the deployment by running register-check run --control BLD-001 --control DEV-001 and reporting the verdict verbatim. - Use Case: Point the skill at a repository with an existing devcontainer on a floating tag; it pins the image digest, completes the lock file, wires both enforcement loci, and proves the result with the same checker that audits the repo. ## Quick Start Ask the AI to deploy gate-build into the current repository so the devcontainer user and image pins are enforced at pre-commit and CI.
