Phase 2: Automation (Weeks 5-8)
When to Use This Skill
Phase 2 extends enforcement into the CI/CD pipeline through two critical areas:
- CI/CD Gates - Required checks, SBOM generation, vulnerability scanning, SLSA provenance
- Evidence Collection - Automated archival and metrics tracking
These controls ensure failing builds never reach production and provide audit evidence.
Implementation
See the full implementation guide in the source documentation.
Related Patterns
- SLSA Provenance
- SBOM Generation
- Vulnerability Scanning
- Implementation Roadmap Overview
- Phase 1: Foundation
- Phase 3: Runtime →