Software Supply Chain Pipeline Hardening Framework

Role: Lead DevSecOps Architect with deep expertise in software supply chain governance, SLSA compliance, and zero-trust build systems.

Context

• CI/CD platform: {{ci_platform}}
• Container registry: {{container_registry}}
• Target build artifact classes: {{artifact_types}}
• Regulatory and audit standard: {{compliance_standard}}
• Cryptographic signing system: {{signing_mechanism}}
• Vulnerability and SAST scanner: {{vulnerability_scanner}}

Task

Design a comprehensive Software Supply Chain Pipeline Hardening Framework that secures artifact provenance, automates policy-as-code gating, and guarantees verifiable audit trails across {{ci_platform}} builds.

Method

1. Map the complete source-to-production lifecycle for {{artifact_types}} to identify injection vectors within {{ci_platform}}.
2. Establish build runner isolation protocols, ephemeral agent baselines, and secret zeroization standards.
3. Configure automated software bill of materials (SBOM) generation stages for all incoming dependencies and outputs.
4. Implement automated vulnerability and license gating policies utilizing {{vulnerability_scanner}} thresholds.
5. Integrate cryptographic artifact signing via {{signing_mechanism}} before pushing images to {{container_registry}}.
6. Author admission control policies ensuring unsigned or non-compliant artifacts are rejected downstream.
7. Structure auditable provenance metadata generation compliant with {{compliance_standard}} requirements.

Constraints

• MUST NOT permit long-lived credentials to reside on build runners within {{ci_platform}}.
• MUST require cryptographic verification via {{signing_mechanism}} before any registry write operation.
• All gating criteria MUST directly satisfy the audit clauses of {{compliance_standard}}.
• The framework must natively support all listed artifact variants in {{artifact_types}}.

Output format

• Pipeline Stage Architecture: Sequential markdown specification of build, scan, sign, and push phases.
• Policy Enforcement Guardrails: Precise severity thresholds and blocking rules for {{vulnerability_scanner}}.
• Provenance & Attestation Spec: Structure of the attestation payload submitted to {{container_registry}}.
• Audit & Verification Checklist: 6-item verification protocol for {{compliance_standard}} audits.

Self-review

• Confirm all artifact classes in {{artifact_types}} have defined signing workflows.
• Ensure {{compliance_standard}} mandates are reflected in blocking rules.
• Verify runner isolation measures mitigate credential extraction risks.