What problem does it solve? Repositories often have supply-chain controls that exist on paper but are not enforced: lockfiles committed but ignored by non-frozen installs, dependency updates never proposed, and CI actions referenced by mutable tags that owners can move. This Skill wires those controls into CI workflows, pre-commit hooks, and bot configurations, deriving every value from a central controls.yaml register and verifying its own work with the same checker that audits the repository. ## Core Features & Use Cases - Frozen install wiring (SUP-001): Writes a frozen-lockfile install step at the top of the gating CI job, using the register's command for the ecosystem and lockfile actually present. - Dependency update proposals (SUP-002): Generates a Dependabot or Renovate configuration with one entry per ecosystem detected, plus github-actions and devcontainers entries where those features exist. - Action pinning (SUP-003): Resolves every third-party workflow action tag to its current commit SHA via the GitHub API and rewrites the reference, keeping the tag as a comment; owner-owned actions are exempted. - Digest verification (SUP-004): Ensures pinned release artefact digests are checked against what the project published. - Use Case: Point the skill at a repository with a controls.yaml register, and it produces a reviewable change wiring all four supply-chain controls, then runs register-check to confirm the deployment passes the same audit that will enforce it. ## Quick Start Ask the AI to deploy gate-supply-chain into the current repository using its controls.yaml register and report the checker verdict.
