skills.rest
martinholovsky
martinholovskyCOMMUNITY
Explore all skills by this author →
𝕏@martinholovskyGitHub

sota-devsecops

Audits CI/CD pipelines and supply chains for security risks and compliance gaps.

12|2|Updated Jun 17, 2026
Search Tags:#ci/cd#devsecops#supply chain security#pipeline security#deployment security
One-click install
npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-devsecops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sota-devsecops
Source: https://github.com/martinholovsky/SOTA-skills/tree/main/skills/sota-devsecops
Command: npx skills add https://github.com/martinholovsky/SOTA-skills --skill sota-devsecops

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires actions/configure-aws-credentials, actions/checkout, actions/attest-build-provenance, cosign, github/codeql-action, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you harden and audit your CI/CD pipelines, supply chain, and deployments to protect against known security vulnerabilities and ensure compliance with industry standards.

Core Features & Use Cases

  • CI/CD Pipeline Security: Enforce best practices for permissions, secrets management, and code integrity in GitHub Actions workflows.
  • Supply Chain Security: Apply controls to manage dependencies, scan for vulnerabilities, and ensure artifact integrity.
  • Deployment Security: Implement robust deployment strategies with immutable tags, provenance checks, and drift detection.
  • Use Case: Run the skill in Audit mode to review your existing pipelines and identify potential security risks like misconfigured secrets or inadequate scanning.

Quick Start

Run the skill in Audit mode on your CI/CD pipeline to identify and mitigate security risks.

Frequently Asked Questions about sota-devsecops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my CI/CD pipeline for supply chain security risks?▼

To audit your CI/CD pipeline for supply chain security risks, run this Skill in Audit mode to identify misconfigured secrets, inadequate vulnerability scanning, and pipeline permission issues in your GitHub Actions workflows.

What are the best practices for securing GitHub Actions deployments?▼

Securing GitHub Actions deployments requires enforcing least-privilege permissions, proper secrets management, artifact integrity checks using provenance attestations, and deploying with immutable tags to prevent unauthorized pipeline modifications.

Does this DevSecOps Skill work with cosign and CodeQL for artifact scanning?▼

Yes, this DevSecOps Skill integrates with cosign for artifact signing and integrity, and github/codeql-action for vulnerability scanning, ensuring comprehensive supply chain security throughout your CI/CD workflows.

How do I ensure artifact integrity and provenance in my CI/CD pipeline?▼

To ensure artifact integrity and provenance in your CI/CD pipeline, apply supply chain controls using actions/attest-build-provenance and cosign to sign artifacts, verify origins, and detect drift during deployments.

Do I need AWS credentials configured for pipeline security audits?▼

Yes, if your CI/CD workflows interact with AWS resources, you need actions/configure-aws-credentials properly configured to audit deployment security, manage access controls, and enforce secrets management best practices.

What is software supply chain security and when do I need it?▼

Software supply chain security protects your CI/CD pipelines, dependencies, and deployments from vulnerabilities by enforcing artifact integrity, scanning for risks, and applying provenance checks to ensure compliance and prevent tampering.

Related Skills

Explore More Software Engineering Skills→
codewithmukeshcodewithmukesh
640

ci-cd

Automate .NET build, test, and deployment pipelines with GitHub Actions or Azure DevOps.

Official
Intermediate
vertivolatamvertivolatam
1

Security & Compliance Automation

Automate security and compliance checks for cloud-native environments using OPA, Trivy, and boto3.

Official
Advanced
BagelHoleBagelHole
46

sbom-supply-chain

Generate, sign, and verify SBOMs and provenance attestations with Syft, Grype, and Cosign.

Community
Intermediate
moogieonmoogieon

cso

Audit infrastructure security with Python scripts and external tools.

Community
Advanced