skills.rest
adaptive-enforcement-lab
adaptive-enforcement-labOFFICIAL
Explore all skills by this author →
GitHub

phase-2-automation-weeks-5-8

Automate CI/CD gate enforcement, SBOM generation, vulnerability scanning, and SLSA provenance.

3|3|Updated Jan 4, 2026
Search Tags:#compliance#provenance#ci-cd#sbom#vulnerability-scanning#evidence-collection#secure-supply-chain
One-click install
npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill phase-2-automation-weeks-5-8
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: phase-2-automation-weeks-5-8
Source: https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/enforce/skills/phase-2-automation-weeks-5-8
Command: npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill phase-2-automation-weeks-5-8

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gsutil, gh, jq, git, and includes scripts (resource) components.

What problem does it solve?

Automates enforcement of security gates and provenance in CI/CD to prevent insecure builds and provide auditable artifacts across the software supply chain.

Core Features & Use Cases

  • CI/CD gates enforcement: require SBOM generation, vulnerability scanning, and SLSA provenance before merges or deployments.
  • Evidence collection: automated archival and metrics tracking of build and release activities for compliance and audit trails.
  • Workflow integration: fits with common DevOps tooling to harden the SDLC from development through production.

Quick Start

Enable CI/CD gates, generate SBOMs, scan for vulnerabilities, and collect SLSA provenance and evidence in your build pipelines.

Frequently Asked Questions about phase-2-automation-weeks-5-8

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SBOM generation and SLSA provenance in CI/CD pipelines?▼

Automating SBOM generation and SLSA provenance in CI/CD pipelines is achieved by enforcing security gates that require these artifacts before merges or deployments. The workflow captures provenance and archives build evidence for audit trails.

What is SLSA provenance evidence collection in a secure software supply chain?▼

SLSA provenance evidence collection is the automated archival of build and release activities to provide auditable artifacts. It satisfies secure software supply chain requirements by tracking metrics and proving build integrity.

Can I enforce vulnerability scanning as a CI/CD gate before deployment?▼

Yes, you can enforce vulnerability scanning as a CI/CD gate before deployment. The automation requires scanning to pass alongside SBOM generation and SLSA provenance to prevent insecure builds.

Do I need jq and gh to automate evidence collection in my DevOps workflow?▼

You need jq, gh, git, and gsutil installed to automate evidence collection in your DevOps workflow. These standard tools enable the scripts to interact with repositories, process JSON, and archive artifacts.

What's the best way to harden the SDLC from development through production?▼

The best way to harden the SDLC from development through production is integrating CI/CD gate enforcement with common DevOps tooling. This applies SBOM generation, vulnerability scanning, and SLSA provenance across modern workflows.

Related Skills

Explore More Legal & Compliance Skills→
iani-kuliiani-kuli

github-auth

Configure GitHub authentication via gh CLI or Git credential helpers.

Community
Intermediate
brucebanner010198-commitsbrucebanner010198-commits

sbom-slsa

Generates CycloneDX SBOMs and SLSA provenance for released artifacts.

Community
Advanced
filipnyquistfilipnyquist

cso

Audit security posture across infrastructure, code, and supply chains.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

sbom-provenance

Generate SPDX and CycloneDX SBOMs with build provenance attestation.

Official
Intermediate