sota-devsecops

SOTA DevSecOps & Supply Chain Security

Purpose

This skill encodes the 2026 state of the art for securing the path from source code to running workload: pipeline hardening, dependency and artifact supply chain, build integrity, analysis gates, IaC/deployment security, and runtime policy enforcement. It is defensive: every rule exists to prevent a real, named class of compromise (token theft, workflow injection, dependency confusion, tag mutation, state leakage, bypassable gates).

Two operating modes. Pick one explicitly at the start of the task.

BUILD mode

Use when creating or extending pipelines, Dockerfiles, Terraform, GitOps configs, or dependency tooling.

1. Identify which stages of the source-to-production path the task touches (source → CI → build → artifact → deploy → runtime) and read the matching rules files from the index below BEFORE writing config.
2. Default to the most restrictive option that works: read-only tokens, OIDC over stored keys, SHA pins, digest pins, frozen lockfile installs, non-root distroless runtime. Loosen only with a written reason in a comment.
3. Every gate you add must be a required check that fails closed. A scanner whose job is continue-on-error: true is documentation, not a control.
4. Ship the verification path with the signing path: if you generate provenance/signatures/ SBOMs, also wire the consumer (admission policy, gh attestation verify, cosign verify in CD). Unverified attestations are dead weight.
5. State assumptions you could not verify (org settings, branch protection, registry config) at the end of your work so the operator can confirm them.

AUDIT mode

Use when reviewing existing pipelines, workflows, Dockerfiles, IaC, or dependency posture.

Process: enumerate workflows/build files/IaC; for each, walk the relevant Audit checklist at the end of every rules file; report findings in the format below; do not report style nits as security findings.

Severity conventions

Severity is judged by reachability: who can trigger the path (anonymous > fork PR author > org member > admin) and what it yields (secrets/artifact write > code exec in CI > info leak).

Finding format

[SEVERITY] <short title>
File: <path>:<line>
Issue: <what is wrong, one or two sentences>
Attack path: <who exploits it and how — concrete, not theoretical>
Fix: <exact config change, with snippet when short>
Rule: <rules file # and section>

End every audit with: counts per severity, the top 3 fixes by risk reduction per effort, and an explicit list of what was OUT of scope (org settings, registry config, runner infra you could not see).

Rules index

When a task spans stages (most do), read every matching file. For a full pipeline audit, read all eight.

Top 10 non-negotiables

Violations of these are at minimum High in AUDIT mode and must never be introduced in BUILD mode:

1. Top-level permissions: block in every workflow, starting from contents: read (or {}), elevating per job only. Never rely on org/repo default token permissions.
2. No long-lived cloud credentials in CI secrets. Use OIDC federation with sub-claim conditions scoped to repo + ref/environment.
3. Pin third-party actions (and base images) by full commit SHA / digest, with a version comment, updated by Renovate/Dependabot. Tags are mutable attack surface.
4. Never combine untrusted PR code with secrets or write tokens. pull_request_target (or workflow_run) must not check out or execute PR head content; treat fork artifacts as hostile input.
5. No untrusted expression interpolation in run: scripts. PR titles, branch names, issue bodies, commit messages go through env: indirection, quoted.
6. Lockfiles committed; CI installs are frozen (npm ci, --frozen-lockfile, --require-hashes, --locked). A build that resolves versions at build time is not reproducible and not reviewable.
7. Security gates are required status checks that fail closed. No continue-on-error, no || true, no unprotected default branch, no "admins bypass".
8. Build once, promote the same digest through environments. Deploy manifests reference image digests (or signed, verified tags), never :latest.
9. Terraform state is secret material: remote encrypted backend, least-privilege access, plan on PR with read-only creds, apply only a reviewed saved plan via a protected environment.
10. Production admission requires verified provenance: signed images (cosign/Kyverno verifyImages or equivalent), non-root, pinned digests — enforce, don't just audit.

If the user asks for something that violates a non-negotiable, implement the secure alternative and explain the delta; only comply after they acknowledge the risk explicitly.