RepoReady Supply-Chain Guard — 8 SHA-Pinned Workflows for Dependency Review, SBOM, Provenance & Signing

Supply-Chain Guard — single-user license ($12).

Lint-checked and self-tested locally; not yet demonstrated on GitHub Actions runs.

Add a supply-chain layer to any GitHub repo in minutes. Supply-Chain Guard ships 8 original GitHub Actions workflows — every third-party action pinned to a full 40-character commit SHA (with version comment) and every workflow with explicit least-privilege `permissions:`.

What's inside:

• Dependency review on pull requests (fail on high-severity vulnerabilities; optional license policy)
• SBOM generation (SPDX JSON via Syft) kept as a build artifact
• Build provenance attestations for tagged releases (verify with `gh attestation verify`)
• OpenSSF Scorecard workflow with results in your Security tab
• Pin guard + permissions guard — small, dependency-free Python checks that fail CI on unpinned actions or missing/over-broad permissions (self-tests included)
• Workflow audit with zizmor
• Keyless cosign signing for GHCR container images
• README with per-workflow setup, required permissions and customization; small demo project included

Quality, honestly stated: all 8 workflows are lint-clean (actionlint + yamllint, zero errors; zizmor offline audit clean) and the guard scripts pass their bundled self-tests. They have been lint-checked and self-tested only — not yet demonstrated on live GitHub Actions runs.

Plan limits: some features depend on your GitHub plan. For example, dependency review and code-scanning (SARIF) uploads on private repos generally need GitHub Advanced Security, and artifact attestations on private repos generally need GitHub Enterprise Cloud. See the README for details.

Delivery: instant download of RepoReady-SupplyChain-Guard.zip via Payhip after purchase from this Payhip shop (payhip.com/PromptPackShop).

Free starter: RepoReady Lite is free at https://github.com/miketusa-ctrl/repoready

RepoReady Pro (24 workflows) is a separate product; Supply-Chain Guard has no file overlap with it.

Brand: Harlo. Not affiliated with or endorsed by GitHub or the OpenSSF; names are used only to describe compatibility.

Questions/support: digitalpromohub.support@gmail.com