statecraft.
Catalog/statecraft-cli

044-supply-chain-profile

Setup profile revision 18: supply-chain, policy-isolation, workflow-lint, structural-scan and secret-scan jobs

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Amends spec 002's setup profile. github-actions-rust revision 18 adds five required checks to every target: a supply-chain job (cargo-deny, cargo-audit, cargo-vet with exact tool versions), a guard that refuses a pull request mixing dependency or policy files with anything else, a workflow lint (zizmor and an offline refusal of any action not pinned by commit digest), an ast-grep scan where the project declares rules, and a digest-verified gitleaks scan. Each is wired into ci-gate. A target needs a committed deny.toml to upgrade to it.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "additive",
  "spec": "002-environment-lifecycle",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-home/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "006-command-surface",
  "unit": {
    "kind": "directory",
    "path": "crates/statecraft-cli/"
  }
}

Source headings

  1. 044: Supply-chain, policy-isolation, workflow-lint, structural-scan and secret-scan jobs
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 Pinned tools
  6. 3.2 The supply-chain job
  7. 3.3 The policy-isolation guard
  8. 3.4 Workflow lint
  9. 3.5 Structural scan
  10. 3.6 Secret scan
  11. 3.7 ci-gate and the revision
  12. 4. Observable negative cases
  13. 5. This repository's own adoption
  14. 6. Out of scope
  15. 7. Resolved decisions
  16. Verification

Frozen anchors

No frozen anchors declared.