skills.rest
zerAda
zerAdaCOMMUNITY
Explore all skills by this author →
GitHub

supply_chain_security

Sign Docker images with Cosign and generate SBOMs for supply chain security.

Updated Jan 21, 2026
Search Tags:#Docker#SBOM#SLSA#registry management#image security#Cosign
One-click install
npx skills add https://github.com/zerAda/RestaurantAgentAutomation --skill supply-chain-security-zerada
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply_chain_security
Source: https://github.com/zerAda/RestaurantAgentAutomation/tree/main/.claude/skills/12_supply_chain_security
Command: npx skills add https://github.com/zerAda/RestaurantAgentAutomation --skill supply-chain-security-zerada

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill unit manages and verifies Docker image security through signing, SBOM generation, and SLSA provenance, ensuring a robust supply chain security.

Core Features & Use Cases

  • Docker Image Signing: Automates image signing with Cosign to maintain integrity.
  • SBOM Generation: Generates Software Bill of Materials for traceability.
  • SLSA Attestation: Attests to build reproducibility.
  • Registry Management: Manages GHCR registry configurations.
  • Use Case: Use this Skill when rotating Cosign keys, adding new images, or auditing the supply chain.

Quick Start

To rotate Cosign keys for your supply chain, run: ./scripts/rotate_cosign_keys.sh

Frequently Asked Questions about supply_chain_security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Docker image signing with Cosign for supply chain security?▼

Docker image signing with Cosign is automated to maintain image integrity throughout the supply chain. This Skill handles the secure signing process and manages provenance without requiring manual signing intervention for each build.

What is an SBOM and when do I need it for Docker images?▼

An SBOM, or Software Bill of Materials, provides a comprehensive inventory of components within Docker images for traceability. You need it to ensure compliance and verify dependencies when auditing your supply chain.

Does this approach support SLSA attestation and SHA-pinning in GitHub Actions?▼

Yes, SLSA attestation for build reproducibility and SHA-pinning in GitHub Actions are fully supported. The workflow manages GitHub Container Registry configurations to enforce these supply chain security controls.

How do I rotate Cosign keys for my Docker registry?▼

Rotate Cosign keys by executing the provided script `./scripts/rotate_cosign_keys.sh`. This automates the key rotation process to maintain secure signing operations across your Docker images.

Can I use this to manage GitHub Container Registry configurations for new images?▼

Yes, you can manage GitHub Container Registry configurations when adding new images to your supply chain. It handles registry management alongside SBOM generation and SLSA provenance attestation.

Related Skills

Explore More Software Engineering Skills→
asanexampleasanexample
1

supply-chain-onboarding

Automate container image signing and verification in GitHub Actions with Kyverno cosign.

Official
Intermediate
luissimon96luissimon96

graph-dependency

Audit dependencies, generate SBOMs, and check license compliance for software projects.

Community
Advanced
MesferAliMesferAli

github-actions

Design, implement, debug, and secure GitHub Actions CI/CD workflows.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate