release-integrity

Stars9

Forks0

UpdatedApril 27, 2026 at 15:22

Use when reviewing or improving this template's release-integrity story, including artifact verification, SBOMs, attestations, vulnerability scanning, signing guidance, and release-workflow safety. Do not use for general CI validation, GitHub-settings-only work, or unrelated template customization.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

CaseyLabs

CaseyLabs/kc-secure-repo-template

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	release-integrity
description	Use when reviewing or improving this template's release-integrity story, including artifact verification, SBOMs, attestations, vulnerability scanning, signing guidance, and release-workflow safety. Do not use for general CI validation, GitHub-settings-only work, or unrelated template customization.

Release integrity

Use this skill when working on release and artifact integrity for this template.

Use this skill when

changing release workflows
adding or revising SBOM generation
adding or revising vulnerability scanning
adding or revising attestation, provenance, or signing guidance
changing artifact creation, packaging, or publication behavior

Do not use this skill when

the task is ordinary template validation
the task is ordinary GitHub-settings documentation
the task is a general adaptation of the template to a new project
the task is a small bug fix unrelated to release or artifact trust

Goals

Keep release workflows understandable, reviewable, and difficult to bypass.
Improve trust in generated artifacts and release evidence.
Preserve reproducibility and supply-chain safety where practical.

Method

Treat release workflows as sensitive paths.
Review scripts/dist.sh, .github/workflows/build.yml, and release-related config/project.cfg settings as the core release-integrity surface.
Prefer explicit tool versions and pinned actions where practical.
Verify downloaded tools with checksums or signatures when feasible.
Keep SBOM, Grype, checksum, provenance, attestation, and compliance-summary outputs aligned when release behavior changes.
Keep generated artifacts and caches out of the Docker build context where appropriate.
Document any weakening of defaults explicitly.
Keep guidance clear about what evidence a derived repository should produce and why.
Pair this skill with workflow-validation when release changes require make dist, workflow checks, or packaging-manifest validation.

Review priorities

supply-chain risk
workflow bypass risk
artifact integrity gaps
missing verification steps
unclear release evidence
unnecessary complexity

Output expectations

State what changed in the release path.
Call out integrity controls added, removed, or weakened.
Note any follow-up work for externally published artifacts or stronger signing.

More from this repository

same repository

pr-draft-summary

CaseyLabs/kc-secure-repo-template

Draft a concise pull request handoff after substantive repository changes are finished or ready for review. Trigger when wrapping up code, test, script, workflow, release, security, documentation-with-behavior-impact, or template customization changes and the user needs a PR title/body grounded in the real diff, commits, and validations run. Do not use for tiny chat-only answers, speculative plans, or changes that are not ready for PR handoff.

2026-04-289

github-hardening

CaseyLabs/kc-secure-repo-template

Use when updating or reviewing GitHub-side hardening guidance for derived repositories, including required settings, rulesets, scanning, review protections, and workflow permissions. Use terraform-hardening instead for Terraform-backed changes under config/infra. Do not use for ordinary in-repo implementation changes unless the task is primarily about documented GitHub controls.

2026-04-279

language-profile-guidance

CaseyLabs/kc-secure-repo-template

Use when adding or revising optional language-specific guidance for Go, Node.js, SQL, or small polyglot derived repositories without bloating the generic template. Keep language behavior optional. Do not use for generic template policy, routine validation, GitHub-settings-only work, or release-integrity-only work.

2026-04-279

repo-adaptation

CaseyLabs/kc-secure-repo-template

Use when adapting or customizing this repository to meet the needs of the source code under `src/`, including language and framework needs, dependencies, runtime behavior, Docker, Makefile targets, and customization surfaces. Do not use for routine bug fixes, small refactors, pure workflow validation, GitHub-settings-only work, or release-integrity-only work.

2026-04-279

terraform-hardening

CaseyLabs/kc-secure-repo-template

Use when changing or reviewing the Terraform-backed GitHub repository hardening workspace under config/infra, including provider pins, rulesets, default branch protection, required checks, secret scanning, Dependabot security updates, token handling, plan/apply behavior, and infra documentation. Do not use for ordinary app code, generic release integrity, generic template adaptation, or non-infra GitHub Actions changes unless they directly affect hardening expectations.

2026-04-279

workflow-validation

CaseyLabs/kc-secure-repo-template

Use when validating repository workflows after changes to Docker-first Makefile targets, Dockerfiles, scripts, CI, release packaging, smoke tests, or documentation alignment. Do not use for repo redesign, GitHub-policy-only changes, or instruction-only skill edits with no workflow impact.

2026-04-279

name	release-integrity
description	Use when reviewing or improving this template's release-integrity story, including artifact verification, SBOMs, attestations, vulnerability scanning, signing guidance, and release-workflow safety. Do not use for general CI validation, GitHub-settings-only work, or unrelated template customization.

Release integrity

Use this skill when working on release and artifact integrity for this template.

Use this skill when

changing release workflows
adding or revising SBOM generation
adding or revising vulnerability scanning
adding or revising attestation, provenance, or signing guidance
changing artifact creation, packaging, or publication behavior

Do not use this skill when

the task is ordinary template validation
the task is ordinary GitHub-settings documentation
the task is a general adaptation of the template to a new project
the task is a small bug fix unrelated to release or artifact trust

Goals

Keep release workflows understandable, reviewable, and difficult to bypass.
Improve trust in generated artifacts and release evidence.
Preserve reproducibility and supply-chain safety where practical.

Method

Treat release workflows as sensitive paths.
Review scripts/dist.sh, .github/workflows/build.yml, and release-related config/project.cfg settings as the core release-integrity surface.
Prefer explicit tool versions and pinned actions where practical.
Verify downloaded tools with checksums or signatures when feasible.
Keep SBOM, Grype, checksum, provenance, attestation, and compliance-summary outputs aligned when release behavior changes.
Keep generated artifacts and caches out of the Docker build context where appropriate.
Document any weakening of defaults explicitly.
Keep guidance clear about what evidence a derived repository should produce and why.
Pair this skill with workflow-validation when release changes require make dist, workflow checks, or packaging-manifest validation.

Review priorities

supply-chain risk
workflow bypass risk
artifact integrity gaps
missing verification steps
unclear release evidence
unnecessary complexity

Output expectations

State what changed in the release path.
Call out integrity controls added, removed, or weakened.
Note any follow-up work for externally published artifacts or stronger signing.