manage-supply-chain

Automating SBOM generation and artifact signing involves configuring Software Supply Chain Assurance to generate CycloneDX or SPDX SBOMs and sign artifacts with Cosign across build, test, and release pipelines. This Skill automates that Harness SSCA configuration using MCP.

SLSA provenance tracking records artifact build origins, while OPA enforces supply chain policies by evaluating these provenance attestations against defined rules to manage dependency, license, and provenance risks. The Skill automates applying these OPA policies within your pipelines.

Yes, MCP v2 integration is required to automate Software Supply Chain Assurance configuration for generating SBOMs, signing artifacts with Cosign, and tracking SLSA provenance. Clear policy definitions are also necessary to manage supply chain risks effectively.

Yes, you can generate SBOMs in either CycloneDX or SPDX formats with attestation, sign artifacts using Cosign, and track SLSA provenance across build, test, and release pipelines. The Skill provides guidance for SBOM storage, dashboards, and risk analysis.

The best way to enforce SLSA level compliance is by automating OPA-based supply chain policy enforcement alongside SBOM generation and Cosign artifact signing. This approach manages risks related to dependencies, licenses, and provenance across your services.