Name: supply_chain_security
Author: zerAda

Imported from zerAda/RestaurantAgentAutomation (.claude/skills/12_supply_chain_security/SKILL.md). Install upstream with npx skills add zerAda/RestaurantAgentAutomation --skill 12_supply_chain_security. Copyright stays with the author.

Supply Chain Security (RESTO BOT)

Docker image pipeline

Build: project/.github/workflows/build-push-artifacts.yml
Registry: GitHub Container Registry (GHCR)
Images built: gateway, admin-dashboard, kiosk-app, cms (Strapi)

Signing and attestation

Cosign: Image signing with key pair
- Secrets: COSIGN_PASSWORD, COSIGN_PRIVATE_KEY (GitHub Actions secrets)
- Verify: cosign verify --key cosign.pub <image>
SBOM: Software Bill of Materials generated per build
SLSA Provenance: Attestation for build reproducibility

SHA-pinning policy

All GitHub Actions must use SHA-pinned references
Example: uses: actions/checkout@sha256:... (not @v4)
Enforced in CI lint step

Version consistency

N8N_VERSION must match across:
- project/.env
- project/.github/workflows/ci.yml
- project/.github/workflows/security-scan.yml
Base images pinned in Dockerfiles and compose

Image inventory

Image	Source	Signed
nginx:1.27-alpine	Docker Hub	N/A (upstream)
n8n:1.80.0	docker.n8n.io	N/A (upstream)
postgres:15-alpine	Docker Hub	N/A (upstream)
redis:7-alpine	Docker Hub	N/A (upstream)
traefik:v3.6.6	Docker Hub	N/A (upstream)
ollama:0.6.2	Docker Hub	N/A (upstream)
gateway (custom)	GHCR	Cosign
admin-dashboard (custom)	GHCR	Cosign
kiosk-app (custom)	GHCR	Cosign
cms (custom)	GHCR	Cosign

Key files

project/.github/workflows/build-push-artifacts.yml
project/.github/workflows/security-scan.yml (Trivy)
project/admin-dashboard/Dockerfile
project/kiosk-app/Dockerfile
project/inventory-cms/Dockerfile

Required output

Signing verification evidence
SBOM generation confirmation
SHA-pin audit for GitHub Actions
Version consistency check

Install supply_chain_security and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "zerada-restaurantagentautomation-12-supply-chain-security", "kind": "skill", "name": "supply_chain_security", "description": "Docker image signing (Cosign), SBOM generation, SLSA provenance attestation, GHCR registry management.", "publisher": "zerAda", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Docker image signing (Cosign), SBOM generation, SLSA provenance attestation, GHCR registry management." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/zerAda/RestaurantAgentAutomation", "path": ".claude/skills/12_supply_chain_security/SKILL.md", "ref": "01f7d5a305709db391c21d46709728da8382c1dd", "url": "https://github.com/zerAda/RestaurantAgentAutomation/blob/01f7d5a305709db391c21d46709728da8382c1dd/.claude/skills/12_supply_chain_security/SKILL.md", "key": "zerAda/RestaurantAgentAutomation/.claude/skills/12_supply_chain_security/SKILL.md" } }, "instructions": "# Supply Chain Security (RESTO BOT)\n\n## Docker image pipeline\n\n- Build: `project/.github/workflows/build-push-artifacts.yml`\n- Registry: GitHub Container Registry (GHCR)\n- Images built: gateway, admin-dashboard, kiosk-app, cms (Strapi)\n\n## Signing and attestation\n\n- **Cosign**: Image signing with key pair\n - Secrets: COSIGN_PASSWORD, COSIGN_PRIVATE_KEY (GitHub Actions secrets)\n - Verify: `cosign verify --key cosign.pub <image>`\n- **SBOM**: Software Bill of Materials generated per build\n- **SLSA Provenance**: Attestation for build reproducibility\n\n## SHA-pinning policy\n\n- All GitHub Actions m", "cost": { "context_tokens": 458 } }

supply_chain_security

About