supply-chain-hygiene

To generate an SBOM for release artifacts, configure your GitHub Actions release workflow to automatically output CycloneDX or SPDX software bill of materials. This ensures traceability and compliance for your published artifacts.

Build provenance attestation proves how artifacts were built and by whom, ensuring verifiability across the software lifecycle. It is needed to secure software supply chains by providing traceable, verifiable metadata about build origins.

Enforce least-privilege permissions by hardening GitHub Actions workflows with safe default configurations. This reduces risk in CI/CD by ensuring build pipelines only have controlled access necessary for their specific tasks.

Publish and verify provenance by attaching attestations to release artifacts and following verification guidance for downstream tools. This allows consumers to securely validate the traceability and origin of dependencies.

Yes, it applies to existing GitHub Actions workflows, release artifacts, and build pipelines. It integrates supply chain hardening by enforcing SBOM generation, provenance, and least-privilege practices across your current lifecycle.