Container Artifact Supply Chain Vulnerability Evaluation

Role: Lead DevSecOps Architect with deep expertise in container supply chain security, SLSA frameworks, and continuous artifact validation.

Context

• Artifact container registry: {{artifact_registry}}
• Upstream base image ecosystem: {{base_image_source}}
• Static and dynamic scanning tooling: {{scan_tooling}}
• Enforced blocking severity threshold: {{cve_severity_threshold}}
• Current release gate deployment policy: {{release_gate_policy}}
• Engineering organization scale: {{developer_team_size}}

Task

Produce a Comprehensive Container Supply Chain Security Analysis evaluating container artifact risk across {{artifact_registry}}, assessing vulnerability posture under {{scan_tooling}}, and designing an optimized enforcement model for {{cve_severity_threshold}} without impeding the velocity of {{developer_team_size}} engineers.

Method

1. Analyze the integrity and provenance of base images pulled from {{base_image_source}} through the supply chain into {{artifact_registry}}.
2. Evaluate how effectively {{scan_tooling}} identifies operating system packages, language-level runtime dependencies, and configuration vulnerabilities.
3. Audit the current {{release_gate_policy}} to uncover bypass patterns, false-positive handling friction, and exception management gaps.
4. Assess developer feedback loop latency caused by blocking builds at the {{cve_severity_threshold}} threshold.
5. Review Software Bill of Materials (SBOM) generation, signing (e.g., Cosign), and verification processes throughout the build pipeline.
6. Formulate a multi-stage triage model to manage zero-day CVEs, unfixable upstream issues, and patch inheritance.
7. Provide organizational rollout guidance calibrated to maintain developer productivity across {{developer_team_size}} engineers.

Constraints

• The evaluation MUST NOT recommend ignoring unpatched vulnerabilities without documented risk acceptance and automated TTL expiration.
• Policies MUST maintain strict cryptographic verification of image signatures prior to registry admission.
• Recommendations must be compatible with {{artifact_registry}} and {{scan_tooling}} native capabilities.
• Avoid generic security advice; ground every finding in container dependency lifecycles.

Output format

• Supply Chain Security Posture Summary (200 words evaluating current security vs. velocity balance)
• Vulnerability Exposure Vector Breakdown (categorized analysis: OS layers, language packages, base images)
• Pipeline Policy Gate Evaluation (strengths and weaknesses of {{release_gate_policy}} against {{cve_severity_threshold}})
• SBOM & Provenance Architecture Blueprint (step-by-step pipeline signing and verification architecture)
• Developer Workflow Mitigation Plan (concrete guidelines to prevent pipeline friction for {{developer_team_size}} engineers)

Self-review

• Ensure all variables ({{artifact_registry}}, {{base_image_source}}, {{scan_tooling}}, {{cve_severity_threshold}}, {{release_gate_policy}}, {{developer_team_size}}) are contextualized.
• Validate that proposed gate thresholds distinguish between exploitable vulnerabilities and low-risk informational CVEs.
• Verify that SBOM generation and image signing recommendations align with enterprise supply chain standards.