菜单
Phased rollout plan for SDLC hardening. Foundation to runtime enforcement in 90 days. Prioritized by risk and audit importance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Production-grade Go CLI patterns, automated release workflows with Release Please, versioned docs, and coverage enforcement for DevSecOps build pipelines.
Design CLI commands that work independently and compose well for automation. Orchestrator pattern coordinates, subcommands execute discrete tasks.
Implement idiomatic Kubernetes operations with label selectors, strategic merge patches, and proper error handling for production-grade CLI tooling.
Choose the right Go CLI framework for Kubernetes-native tools. Decision matrix compares Cobra, urfave/cli, and Kong for ecosystem alignment and features.
Build Kubernetes-native CLIs in Go with type safety, testability, and complex orchestration logic for deployment tools and cluster automation.
Integrate Go CLIs with Kubernetes using client-go. Automatic config detection works on laptops, CI runners, and cluster pods with minimal RBAC setup.
| name | implementation-roadmap |
| description | Phased rollout plan for SDLC hardening. Foundation to runtime enforcement in 90 days. Prioritized by risk and audit importance. |
You can't harden everything at once. Prioritize controls by risk and audit value.
Phased Rollout
Follow the 12-week timeline to avoid disrupting existing workflows. Skip phases at your own risk.
Three-month plan from foundation to full enforcement.
You can't harden everything at once. Prioritize controls by risk and audit value.
Phased Rollout
Follow the 12-week timeline to avoid disrupting existing workflows. Skip phases at your own risk.
Three-month plan from foundation to full enforcement.
Goal: Core enforcement in place. Evidence collection begins.
Tasks:
main and production branchesenforce_adminsValidation:
gh api repos/org/repo/branches/main/protection \
| jq '{reviews: .required_pull_request_reviews, admins: .enforce_admins}'
Documentation: Update CONTRIBUTING.md with review requirements.
Tasks:
required-checks.yml workflow (tests, lint)Workflow:
See examples.md for detailed code examples.
Validation: Open PR, verify checks block merge until passing.
Tasks:
Validation:
- name: Test app token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}
Migration tracking: Document remaining PAT usages for month 2.
Tasks:
Workflow:
See examples.md for detailed code examples.
Validation: Verify files appear in GCS bucket.
Goal: Add secrets detection, commit signing, and SBOM generation.
Tasks:
.pre-commit-config.yaml--no-verify tracking)Pre-commit hook:
repos:
- repo: https://github.com/trufflesecurity/trufflehog
rev: v3.63.0
hooks:
- id: trufflehog
entry: trufflehog filesystem --fail --no-update
Validation: Attempt to commit AWS key, verify block.
See Pre-commit Security Gates for full implementation.
Tasks:
required_signatures on protected branchesConfiguration:
git config --global user.signingkey YOUR_GPG_KEY_ID
git config --global commit.gpgsign true
Validation:
git log --show-signature | grep "Good signature"
See Commit Signing for setup guide.
Tasks:
Workflow:
See examples.md for detailed code examples.
Validation: Download artifact, verify SBOM contains expected dependencies.
See SBOM Generation for full implementation.
Tasks:
grep -r GITHUB_TOKEN .github/)Validation: No PATs referenced in active workflows.
Goal: Simulate audit, fix gaps, add runtime enforcement.
Tasks:
Workflow:
- name: Scan container
run: |
trivy image --severity HIGH,CRITICAL --exit-code 1 \
gcr.io/project/app:${{ github.sha }}
Validation: Introduce test vulnerability, verify build fails.
See Zero-Vulnerability Pipelines.
Tasks:
Core policy:
See examples.md for detailed code examples.
Validation: Deploy pod without limits, verify rejection.
See Policy-as-Code with Kyverno for end-to-end implementation.
Tasks:
Simulation script:
# Verify branch protection
gh api repos/org/repo/branches/main/protection
# Sample March PRs
gh api 'repos/org/repo/pulls?state=closed&base=main' \
--jq '.[] | select(.merged_at | startswith("2025-03"))'
# Check signature coverage
./scripts/signature-coverage.sh 2025-03-01 2025-04-01
Validation: Evidence collection succeeds for sampled period.
Tasks:
Runbook sections:
Validation: Team can retrieve evidence without assistance.
Week 1: Protection enabled. Week 4: Evidence collected. Week 12: Audit simulation passed. Controls enforced. System hardened.
Goal: Core enforcement in place. Evidence collection begins.
Tasks:
main and production branchesenforce_adminsValidation:
gh api repos/org/repo/branches/main/protection \
| jq '{reviews: .required_pull_request_reviews, admins: .enforce_admins}'
Documentation: Update CONTRIBUTING.md with review requirements.
Tasks:
required-checks.yml workflow (tests, lint)Workflow:
See examples.md for detailed code examples.
Validation: Open PR, verify checks block merge until passing.
Tasks:
Validation:
- name: Test app token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}
Migration tracking: Document remaining PAT usages for month 2.
Tasks:
Workflow:
See examples.md for detailed code examples.
Validation: Verify files appear in GCS bucket.
Goal: Add secrets detection, commit signing, and SBOM generation.
Tasks:
.pre-commit-config.yaml--no-verify tracking)Pre-commit hook:
repos:
- repo: https://github.com/trufflesecurity/trufflehog
rev: v3.63.0
hooks:
- id: trufflehog
entry: trufflehog filesystem --fail --no-update
Validation: Attempt to commit AWS key, verify block.
See Pre-commit Security Gates for full implementation.
Tasks:
required_signatures on protected branchesConfiguration:
git config --global user.signingkey YOUR_GPG_KEY_ID
git config --global commit.gpgsign true
Validation:
git log --show-signature | grep "Good signature"
See Commit Signing for setup guide.
Tasks:
Workflow:
See examples.md for detailed code examples.
Validation: Download artifact, verify SBOM contains expected dependencies.
See SBOM Generation for full implementation.
Tasks:
grep -r GITHUB_TOKEN .github/)Validation: No PATs referenced in active workflows.
Goal: Simulate audit, fix gaps, add runtime enforcement.
Tasks:
Workflow:
- name: Scan container
run: |
trivy image --severity HIGH,CRITICAL --exit-code 1 \
gcr.io/project/app:${{ github.sha }}
Validation: Introduce test vulnerability, verify build fails.
See Zero-Vulnerability Pipelines.
Tasks:
Core policy:
See examples.md for detailed code examples.
Validation: Deploy pod without limits, verify rejection.
See Policy-as-Code with Kyverno for end-to-end implementation.
Tasks:
Simulation script:
# Verify branch protection
gh api repos/org/repo/branches/main/protection
# Sample March PRs
gh api 'repos/org/repo/pulls?state=closed&base=main' \
--jq '.[] | select(.merged_at | startswith("2025-03"))'
# Check signature coverage
./scripts/signature-coverage.sh 2025-03-01 2025-04-01
Validation: Evidence collection succeeds for sampled period.
Tasks:
Runbook sections:
Validation: Team can retrieve evidence without assistance.
Week 1: Protection enabled. Week 4: Evidence collected. Week 12: Audit simulation passed. Controls enforced. System hardened.
See examples.md for code examples.
See reference.md for complete documentation.