supply-chain-security

Use when securing build and release pipelines with signing, SBOMs, provenance, and dependency scanning. USE FOR: sign container image with Cosign, generate CycloneDX or SPDX SBOM, add SLSA provenance to GitHub Actions, scan dependencies and images for vulnerabilities, verify release artifact integrity. DO NOT USE FOR: application authorization logic, runtime incident triage only.