irahardianto/agy-perf-optimization-demo/supply-chain-security

Supply Chain Security Principles

Guidelines for securing the software supply chain.

When to Invoke

• Auditing project dependencies
• Setting up CVE scanning in CI/CD
• License compliance review
• Responding to supply chain vulnerability disclosures

Dependency Security

CVE Scanning

Scanning Frequency

• Every CI run — fail build on critical/high CVEs
• Weekly scheduled scan — catch newly disclosed vulnerabilities
• On dependency update — verify new version is clean

SBOM (Software Bill of Materials)

Generation

# CycloneDX format (recommended)
# Go
cyclonedx-gomod mod -json -output sbom.json
 
# Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
 
# Python
cyclonedx-py poetry --format json -o sbom.json

Usage

• Attach SBOM to releases
• Track all transitive dependencies
• Enable downstream vulnerability analysis

License Compliance

Risk Levels

Automation

• Use license-checker (Node.js), pip-licenses (Python), cargo-license (Rust)
• Maintain allowlist/denylist of approved licenses
• Fail CI on disallowed licenses

Supply Chain Attack Prevention

1. Lock files committed — package-lock.json, go.sum, Cargo.lock, poetry.lock
2. Pin exact versions in production — no floating ranges
3. Verify checksums — lock files contain integrity hashes
4. Review new dependencies — check maintainer, downloads, last commit, open issues
5. Minimal dependencies — each dep = increased attack surface
6. Signed commits and releases — verify artifact provenance

Related

• Dependency Management Principles @.agents/rules/dependency-management-principles.md
• Security Principles .agents/rules/security-principles.md
• Security Mandate .agents/rules/security-mandate.md