supply-chain-audit

To audit your repository for supply chain security risks, run the audit at the repository root. It detects npm, Python, Docker, and GitHub Actions ecosystems, inventories relevant controls, and generates evidence-backed findings from structured checklists.

The best way to harden your GitHub Actions and Docker supply chain defenses is to use a remediation plan that proposes precise diffs with honest impact statements. Changes are only applied after explicit user approval, ensuring traceable and reversible modifications.

No, this supply chain audit does not automatically apply fixes to your npm and Python dependencies. It enforces gating between phases by generating a diffs-based remediation plan that requires explicit user approval before applying any changes.

Yes, you can use this audit tool with a multi-ecosystem project containing both npm and Python. It specifically applies to multi-ecosystem projects by detecting various environments and auditing each against a structured, evidence-backed checklist.

The supply chain audit ensures changes are traceable and reversible by relying on frontmatter metadata in SKILL.md, reference checklists, and a diffs-based Phase 3 plan. This structure enforces gating between phases with explicit user approval before applying modifications.

You need a supply chain audit for your GitHub Actions and Docker configurations when you want to inventory existing security controls and identify vulnerabilities. It quotes findings verbatim from reference files to provide structured, evidence-backed risk assessments for your repositories.