sota-devsecopslisted

# SOTA DevSecOps & Supply Chain Security ## Purpose This skill encodes the 2026 state of the art for securing the path from source code to running workload: pipeline hardening, dependency and artifact supply chain, build integrity, analysis gates, IaC/deployment security, and runtime policy enforcement. It is defensive: every rule exists to prevent a real, named class of compromise (token theft, workflow injection, dependency confusion, tag mutation, state leakage, bypassable gates). Two operating modes. Pick one explicitly at the start of the task. ## BUILD mode Use when creating or extending pipelines, Dockerfiles, Terraform, GitOps configs, or dependency tooling. 1. Identify which stages of the source-to-production path the task touches (source → CI → build → artifact → deploy → runtime) and read the matching rules files from the index below BEFORE writing config. 2. Default to the most restrictive option that works: read-only tokens, OIDC over stored keys, SHA pins, digest pins, frozen lockfile installs, non-root distroless runtime. Loosen only with a written reason in a comment. 3. Every gate you add must be a **required** check that fails closed. A scanner whose job is `continue-on-error: true` is documentation, not a control. 4. Ship the verification path with the signing path: if you generate provenance/signatures/ SBOMs, also wire the consumer (admission policy, `gh attestation verify`, cosign verify in CD). Unverified attestations are dead