Menu
Android 供應鏈安全 — 依賴治理、SCA（OSV-Scanner / Dependabot）、SBOM（CycloneDX/SPDX）、SLSA Provenance、Sigstore 簽章、Signing & Secrets 管理、License Compliance，產出可審計的供應鏈防護
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Android 17 個技能的導航中樞 — 依場景路由到 2-3 個技能組合，含 Skill Dependency Graph、易混淆 skill 邊界對照表、2026-04 重構說明
Kotlin 程式碼規範 — 命名、Detekt 1.25+ / Ktlint 1.4+ 配置、Compose Stability/Compiler Metrics、SuppressLint 多模組策略、KDoc 與 Code Review Checklist，產出可在 CI 強制的風格基線
Android Crash/ANR/結構化日誌的「實作層」 — Firebase Crashlytics 33.x、Custom Signals/OnFatalException、Android 14 ANR Watchdog（含 foreground threshold）、Memory Warning、Timber、Play Console + Firebase 警報聯動，產出可定位的事件流
Android 資料層 — Room 2.7+ Migration / Paging 3 / FTS、Retrofit + OkHttp 統一錯誤處理、Offline-First SSOT、Sync Manager + WorkManager、Protobuf DataStore、Room vs SQLDelight 決策矩陣，產出可離線可同步的資料層
Android 效能定位與優化（數據驅動） — Macrobenchmark / Baseline Profiles / Startup Profiles、Perfetto trace、JankStats 量化門檻、Memory Profiler / Native Profiler / Flame Graph、R8 優化、Play Console App Quality Insights，產出可進 CI gate 的效能基線
Hilt 2.52+ 進階用法 — Assisted Injection、Custom Components/Scopes、Multi-binding、EntryPoint 跨模組安全、KSP2 取代 kapt、@UninstallModules 測試策略，產出可測試的多模組 DI 架構
| id | supply_chain_security |
| name | Supply Chain Security |
| description | Android 供應鏈安全 — 依賴治理、SCA（OSV-Scanner / Dependabot）、SBOM（CycloneDX/SPDX）、SLSA Provenance、Sigstore 簽章、Signing & Secrets 管理、License Compliance，產出可審計的供應鏈防護 |
| type | skill |
本 skill 涵蓋從「第三方依賴進入專案」到「APK/AAB 簽章上架」的完整供應鏈防護。Secrets 與 Signing 在 2026-04 重構時由 release_automation 移交至此，集中治理。CI/CD pipeline 本身的設定與 build optimization 仍屬 @release_automation。
@release_automation@data_layer_mastery@release_automation| 工具 | 用途 | 推薦理由 |
|---|---|---|
| OSV-Scanner | 依賴漏洞掃描 | Google 官方、覆蓋 OSV.dev DB、JVM/Maven 支援好 |
| Dependabot | 自動 PR 升級 | 與 GitHub 整合最深 |
| CycloneDX Gradle Plugin | SBOM 產生 | 業界主流、CycloneDX 1.5/SPDX 雙格式 |
| SLSA GitHub Generator | Build provenance | SLSA Level 3，GitHub Actions 原生支援 |
| Sigstore (cosign) | Keyless signing | 短壽命憑證、Rekor 透明日誌 |
| FOSSA / Black Duck / ScanCode | License compliance | 商用 vs OSS 二選一 |
| TruffleHog / gitleaks | Secret scanning | pre-commit + CI 雙層 |
目標: <例：每月 release 附 SBOM + SLSA L3 provenance>
依賴清單來源: gradle/libs.versions.toml
SCA 工具: OSV-Scanner (CI), Dependabot (PR)
SBOM 格式: CycloneDX 1.5 (生產), SPDX 2.3 (備用)
簽章策略:
- Upload key: AWS KMS (HSM-backed)
- Distribution: Play App Signing
- Provenance: cosign + Rekor
Secret store: GitHub OIDC + cloud KMS（無長壽憑證）
驗收: Quick Checklist
# gradle/libs.versions.toml
[versions]
kotlin = "2.1.0"
hilt = "2.52"
retrofit = "2.11.0"
[libraries]
hilt-android = { group = "com.google.dagger", name = "hilt-android", version.ref = "hilt" }
retrofit = { group = "com.squareup.retrofit2", name = "retrofit", version.ref = "retrofit" }
// settings.gradle.kts — repository 白名單
dependencyResolutionManagement {
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
repositories {
google()
mavenCentral()
// 禁用 jcenter()、jitpack 等未審核來源
}
}
// build-logic/.../GuardConventions.kt
configurations.all {
resolutionStrategy {
failOnDynamicVersions() // 禁 1.2.+
failOnChangingVersions() // 禁 SNAPSHOT
failOnNonReproducibleResolution()
}
}
./gradlew dependencies --write-locks
git add gradle.lockfile
每次升級必須重新生成 lock file 並通過 review。
# .github/workflows/sca.yml
name: SCA
on: [pull_request]
jobs:
osv-scan:
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main
with:
scan-args: |-
--recursive
--skip-git
./
fail-on-vuln: true
| 嚴重度 | 處置時限 | CI 行為 |
|---|---|---|
| Critical (CVSS 9.0+) | 24 小時 | 阻擋 merge、阻擋 release |
| High (7.0-8.9) | 7 天 | 阻擋 merge |
| Medium (4.0-6.9) | 30 天 | 警告但可 merge |
| Low (< 4.0) | 90 天 | 記錄即可 |
// 強制升級 transitive dep（不改 direct dep 版本）
configurations.all {
resolutionStrategy {
force("com.fasterxml.jackson.core:jackson-databind:2.17.2")
eachDependency {
if (requested.group == "io.netty" && requested.version!!.startsWith("4.1.")) {
useVersion("4.1.115.Final")
because("CVE-2024-XXXXX")
}
}
}
}
每個 force 必須有 because 註記，並追蹤上游發版。
// build.gradle.kts
plugins {
id("org.cyclonedx.bom") version "1.10.0"
}
tasks.cyclonedxBom {
setIncludeConfigs(listOf("releaseRuntimeClasspath"))
setSkipConfigs(listOf("debugRuntimeClasspath"))
setOutputFormat("json")
setOutputName("sbom-${project.version}")
setSchemaVersion("1.5")
setProjectType("application")
}
CI 步驟：
- name: Generate SBOM
run: ./gradlew :app:cyclonedxBom
- name: Upload SBOM artifact
uses: actions/upload-artifact@v4
with:
name: sbom
path: app/build/reports/sbom-*.json
retention-days: 365
審計要求 SPDX 時用 spdx-gradle-plugin 並存兩份。
目標：Level 3 — provenance 由可信 builder 簽發、不可竄改。
# .github/workflows/release.yml
jobs:
build:
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
steps:
- uses: actions/checkout@v4
- run: ./gradlew :app:bundleRelease
- id: hash
run: |
echo "hashes=$(sha256sum app/build/outputs/bundle/release/*.aab | base64 -w0)" >> "$GITHUB_OUTPUT"
provenance:
needs: build
permissions:
id-token: write
contents: write
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
with:
base64-subjects: ${{ needs.build.outputs.hashes }}
provenance-name: app-release.intoto.jsonl
驗證：
slsa-verifier verify-artifact app-release.aab \
--provenance-path app-release.intoto.jsonl \
--source-uri github.com/org/repo
避免長壽 signing key 外洩風險。Android AAB 不能直接用 cosign（需 jarsigner-compatible），但可對「附隨 artifact」（SBOM、provenance、mapping.txt）做 cosign。
- uses: sigstore/cosign-installer@v3
- name: Sign SBOM
env:
COSIGN_EXPERIMENTAL: "true"
run: |
cosign sign-blob \
--bundle sbom.cosign.bundle \
app/build/reports/sbom-${VERSION}.json
驗證者只需 cosign + repo 名，不需密鑰。
permissions:
id-token: write
contents: read
jobs:
release:
steps:
- uses: google-github-actions/auth@v2
with:
workload_identity_provider: projects/X/locations/global/workloadIdentityPools/gh/providers/gh
service_account: ci-signer@project.iam.gserviceaccount.com
- name: Sign AAB via KMS
run: |
gcloud kms ... # 產生簽章請求
jarsigner -keystore NONE -storetype PKCS11 \
-providerClass sun.security.pkcs11.SunPKCS11 \
-providerArg pkcs11.cfg \
app-release.aab key-alias
# .github/workflows/secrets.yml
- uses: trufflesecurity/trufflehog@main
with:
extra_args: --only-verified --fail
# .pre-commit-config.yaml
repos:
- repo: https://github.com/gitleaks/gitleaks
rev: v8.21.0
hooks:
- id: gitleaks
git filter-repo 清除歷史並 force push（評估影響範圍後）。@observability_strategy 補相對應的告警。plugins {
id("com.github.jk1.dependency-license-report") version "2.9"
}
licenseReport {
allowedLicensesFile = file("$rootDir/config/allowed-licenses.json")
filters = arrayOf(
com.github.jk1.license.filter.LicenseBundleNormalizer()
)
}
// config/allowed-licenses.json
{
"allowedLicenses": [
{ "moduleLicense": "Apache.*" },
{ "moduleLicense": "MIT" },
{ "moduleLicense": "BSD.*" }
]
}
CI 步驟：
./gradlew checkLicense || exit 1
GPL/AGPL/SSPL 預設禁用；商業專案使用 GPL library 需法務簽核並記錄豁免。
@release_automation：CI workflow 框架、Build Speed、應用層安全（Cert Pinning / NSC）；本 skill 提供 SCA / SBOM / Signing 區塊讓它組裝。@platform_modernization_2026：升級 Gradle/AGP 後需重生 SBOM、重跑 OSV-Scanner。@observability_strategy：把 SCA 失敗、簽章驗證失敗事件納入告警。@project_bootstrapping：新專案直接套用本 skill 的 Version Catalog + 鎖版本範例。