adaptive-enforcement-lab
114 verified skills294 total stars
slsa-provenance-toolchain-integration
SLSA provenance for Go, Node.js, and Python: binary builds, package publishing, container images, and dependency verification with cryptographic integrity proofs.
tools3
runtime-deployment-admission-control-with-kyverno
Deploy Kyverno admission control as final safety net before production. Install admission webhooks, policy reporters, and continuous compliance background scans.
development3
third-party-action-risk-assessment
Structured framework for evaluating GitHub Actions security before adoption. Trust tiers, risk assessment checklist, and decision tree for action evaluation.
development3
self-hosted-runner-security-overview
Understanding the threat model for self-hosted GitHub Actions runners. GitHub-hosted vs self-hosted comparison and secure deployment patterns.
testing3
policy-as-code-template-library
Production-ready policy template library: 48 battle-tested policies (28 Kyverno + 20 OPA). Pod security, image validation, RBAC, resource governance, network security, and CI/CD integration.
development3
phase-2-automation-weeks-5-8
Automation phase SDLC hardening overview. CI/CD gates, SBOM generation, vulnerability scanning, SLSA provenance, and automated evidence collection for secure software supply chain enforcement.
tools3
opa-resource-governance-templates
OPA resource governance policies enforcing CPU/memory limits, ResourceQuota compliance, LimitRange validation, and storage constraints.
development3
opa-rbac-templates
OPA RBAC policies preventing cluster-admin privilege escalation, restricting privileged verbs, and blocking wildcard permissions.
testing3
phase-1-foundation-weeks-1-4
Deploy pre-commit hooks for secrets detection, branch protection with required reviews, commit signature verification, and org-wide distribution strategies.
devops3
policy-as-code-operations
Manage Kyverno policy lifecycle from creation to enforcement. Add policies safely, monitor compliance, handle exceptions, and maintain GitOps-driven operations.
development3
phase-3-runtime-weeks-9-12
Runtime enforcement phase overview. Policy-as-code with Kyverno, resource limits, image source verification, security context enforcement, and policy observability for production Kubernetes hardening.
development3
phase-4-advanced-month-4
Audit evidence collection and compliance validation. Automated archival, OpenSSF Scorecard monitoring, SLSA verification, and continuous proof of controls.
testing3
opa-policy-templates
OPA Gatekeeper policy templates overview. 20 production-ready constraint templates for pod security, image validation, RBAC, and resource governance.
development3
kyverno-basics
Install Kyverno, create validation policies, and understand audit vs enforce modes for Kubernetes admission control.
testing3
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
testing3
slsa-implementation-playbook
Complete SLSA implementation playbook: clarify SLSA vs SBOM confusion, classify runner configurations, implement verification workflows, and adopt incrementally from Level 1 to Level 3.
tools3
actions-integration
Integrate GitHub Core Apps with Actions workflows for org-scoped automation. Generate tokens, access APIs, and implement cross-repository operations patterns.
tools3
sdlc-hardening-implementation-roadmap
Deploy defense-in-depth SDLC hardening across four phases: pre-commit hooks, CI/CD gates, runtime enforcement, and continuous audit evidence collection systems.
testing3
risk-prioritization-framework-for-engineers
Risk prioritization framework for engineers. CVSS interpretation, exploitability analysis, blast radius calculation, and decision trees for patch management and vulnerability remediation.
development3
fail-fast
Detect and halt on precondition failures before expensive operations begin. Validate inputs, permissions, and state upfront in CI/CD and automation workflows.
tools3
file-distribution
Automated file distribution across multiple repositories with three-stage workflow. Discovery, parallel distribution, and summary reporting for consistent updates.
business3
matrix-distribution
Parallelize operations across dynamic target lists using GitHub Actions matrix strategies with failure isolation, rate limiting, and conditional logic.
data-ai3
implementation-patterns
Five idempotency patterns for automation: check-before-act, upsert, force overwrite, unique identifiers, and tombstones. Choose based on constraints and APIs.
tools3
idempotency
Build automation that survives reruns. Idempotent operations let you rerun workflows without fear of duplicates, corruption, or cascading failures in CI/CD.
tools3
graceful-degradation
Build tiered fallback systems that degrade performance, not availability. Cache layers, API resilience, and automatic failover patterns for platform reliability.
development3
hub-and-spoke
Centralized orchestration with distributed execution. One coordinator spawns many workers in parallel. Scale horizontally without changing hub logic.
tools3
documentation-as-skills
Compile MkDocs documentation into Claude Code skills so patterns reach engineers inside the agent instead of waiting to be searched for.
development3
command-architecture
Design CLI commands that work independently and compose well for automation. Orchestrator pattern coordinates, subcommands execute discrete tasks.
tools3
common-operations
Implement idiomatic Kubernetes operations with label selectors, strategic merge patches, and proper error handling for production-grade CLI tooling.
tools3
build
Production-grade Go CLI patterns, automated release workflows with Release Please, versioned docs, and coverage enforcement for DevSecOps build pipelines.
tools3
kubernetes-integration
Integrate Go CLIs with Kubernetes using client-go. Automatic config detection works on laptops, CI runners, and cluster pods with minimal RBAC setup.
tools3
testing-strategies
Build confidence with comprehensive CLI testing. Unit tests catch logic bugs with fakes, integration tests verify API contracts, E2E tests validate workflows.
tools3
packaging
Package Go CLIs as minimal secure containers with distroless base images. Static binaries, non-root users, read-only filesystems for production.
tools3
framework-selection
Choose the right Go CLI framework for Kubernetes-native tools. Decision matrix compares Cobra, urfave/cli, and Kong for ecosystem alignment and features.
tools3
release-please-configuration
Configure automated versioning with release-please. Set up semantic versioning, changelog generation, and monorepo support using GitHub App token authentication.
documentation3
ci-integration-automated-policy-enforcement
Block non-compliant manifests at merge time using policy-platform container in CI. Automate Kyverno validation across environments with zero configuration drift.
testing3
enforce
Make security mandatory through automation. Branch protection, pre-commit hooks, status checks, policy-as-code, and SLSA provenance for SOC 2 compliance.
tools3
incident-response-playbook-templates
Incident response playbook templates for Kubernetes. Detection, containment, remediation, and post-incident procedures with decision trees and validation steps.
testing3
jmespath-for-kyverno
Master JMESPath for Kyverno policies. Query nested resources, build complex conditions, and validate Kubernetes workloads with production-tested patterns.
development3
kyverno-generation-templates
Kyverno generation policy templates that auto-create supporting resources like NetworkPolicies, ResourceQuotas, and PodDisruptionBudgets for new workloads and namespaces.
testing3
kyverno-image-validation-templates
Kyverno image validation: registry allowlists, digests, signatures, and CVE scanning gates for K8s supply chain security.
testing3
kyverno-mutation-templates
Kyverno mutation policies that auto-inject labels, sidecars, and configuration into Kubernetes workloads at admission time.
testing3
kyverno-network-security-templates
Kyverno network security policies that enforce NetworkPolicy requirements, Ingress rules, and Service restrictions in Kubernetes.
testing3
kyverno-policy-templates
Kyverno policy templates overview. 28 production-ready policies for pod security, image validation, resource limits, network security, mutation, and generation.
testing3
kyverno-pod-security-templates
Kyverno pod security policies enforcing Pod Security Standards, privilege restrictions, and security profiles for Kubernetes workloads.
testing3
kyverno-resource-governance-templates
Kyverno resource governance policies enforcing CPU/memory limits, HPA requirements, and storage constraints for Kubernetes workloads.
development3
opa-image-security-templates
OPA image security policies for container registry allowlisting, digest enforcement, and signature verification in Kubernetes.
testing3
opa-pod-security-templates
OPA pod security policies preventing privileged containers, restricting Linux capabilities, and enforcing security contexts in Kubernetes.
testing3
concurrency-control
Prevent workflow conflicts with mutex synchronization, semaphores for limited parallelism, and TTL strategies for automatic cleanup of completed workflows.
tools3
reliability-patterns
Build resilient event systems with retry strategies, dead letter queues, and EventBus persistence. Handle failures gracefully in production deployments.
development3
hardened-release-workflow
Production-ready release workflow examples with signed releases, SLSA provenance, artifact attestations, and minimal permissions.
testing3
reusable-workflow-security
Secure reusable workflow patterns for GitHub Actions. Input validation, secret inheritance, caller restrictions, and SHA pinning for workflow composition.
testing3
chaos-experiment-design
Chaos experiment design methodology. Hypothesis formation, success criteria definition, blast radius control, validation patterns, and SLI monitoring for effective chaos engineering.
development3
storing-credentials
Securely store GitHub App credentials across different environments. GitHub Actions secrets, external CI, Kubernetes, and automated rotation patterns.
testing3
argo-events-setup-guide
Deploy event-driven automation with EventSource, EventBus, and Sensor configuration. Complete setup guide for production Argo Events on Kubernetes clusters.
tools3
chaos-engineering-for-kubernetes
Chaos engineering for Kubernetes with Chaos Mesh and LitmusChaos. Pod deletion, network chaos, resource chaos, blast radius control, and validation patterns for reliability testing.
testing3
event-routing
Control event flow from EventSources to triggers. Master filtering, transformation, and multi-action capabilities for sophisticated event-driven automation.
tools3
error-handling
Handle token failures, API rate limits, and permission errors in GitHub Actions workflows with retry logic, validation checks, and actionable error messages.
development3
oauth-user-authentication
OAuth flows for user-context operations. Web application patterns, device flow for CLI tools, and token refresh strategies for GitHub Apps.
tools3
jwt-authentication
Generate JWTs for GitHub App authentication. Direct JWT generation for app-level operations, installation discovery, and bootstrapping workflows.
tools3
installation-token-generation
Generate short-lived installation tokens from GitHub App credentials with actions/create-github-app-token. Organization-scoped and repository-scoped patterns for automated cross-repo workflows.
tools3
matrix-filtering-and-deduplication
Reduce matrix builds from 47 jobs to 3 with path filtering, deduplication, and dynamic generation. Run only what changed and eliminate redundant combinations.
development3
patterns
Battle-tested automation patterns for GitHub Actions, Argo, and Kubernetes. Build resilient, idempotent workflows that scale with hub-and-spoke design.
tools3
troubleshooting
Debug event flows systematically from EventSource to Workflow. Use diagnostic commands and logging levels to isolate failures in production event systems.
development3
secure-by-design-pattern-library
Secure-by-design architecture patterns for Kubernetes. Zero trust, defense in depth, least privilege, and fail-secure patterns with implementation examples and threat models.
development3
strangler-fig
Incremental migration from legacy systems. Run old and new in parallel, gradually shift traffic, rollback at any point. Zero downtime, production-validated.
testing3
separation-of-concerns-pattern-overview
Single-responsibility components with clear boundaries. Orchestration separate from execution. Build maintainable systems through component isolation.
development3
scheduled-workflows
CronWorkflow patterns for scheduled automation: time-based execution, concurrency policies, orchestration pipelines, and GitHub Actions integration for DevSecOps.
tools3
prerequisite-checks
Consolidate all precondition validation into a dedicated gate phase. Check tools, permissions, state, and resources before executing deployment or automation tasks.
tools3
token-lifecycle-management
Token expiration handling, refresh strategies, and caching patterns for long-running workflows. Manage installation token lifecycle and rate limits in GitHub Actions.
tools3
workflow-composition
Build complex pipelines from reusable workflow components. Compose parent-child workflows, orchestrate multi-stage automation, and eliminate copy-paste YAML.
tools3
tombstone-marker-files
Leave markers indicating operations completed. Track progress across complex multi-step workflows. Perfect for resumable operations and distributed systems.
tools3
work-avoidance-techniques
Layer work avoidance checks from existence to content to semantic comparison. Each technique catches different skip scenarios for maximum automation efficiency.
tools3
work-avoidance-in-github-actions
Skip unnecessary CI/CD operations before execution. Detect unchanged content, cached builds, and irrelevant paths to reduce workflow costs and execution time.
development3
work-avoidance
Skip work when outcomes won't change. Detect unchanged content, existing resources, and cached outputs to prevent unnecessary PRs, builds, and processing cycles.
development3
workflowtemplate-patterns
WorkflowTemplate foundations: versioned, reusable automation building blocks with parameter contracts, error handling, volumes, and RBAC for production workflows.
tools3
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
testing3
github-actions-security-cheat-sheet
Quick reference for GitHub Actions security patterns. Copy-paste snippets for action pinning, token permissions, secrets, runners, and workflow hardening.
testing3
environment-protection-patterns
Deployment protection with environment protection rules, required reviewers, wait timers, and approval gates for production deployments.
devops3
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
devops3
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
testing3
hardened-ci-workflow
Production-ready CI workflow examples with all security patterns applied. SHA pinning, minimal permissions, secret scanning, and language-specific variants.
testing3
iam-configuration
Least-privilege IAM roles for GKE nodes and workloads. Workload Identity Federation for external authentication and comprehensive audit logging for visibility.
testing3
hardened-deployment-workflow
Production-ready deployment workflow examples with OIDC authentication, environment protection, approval gates, and rollback patterns.
devops3
gke-security-hardening-guide
GKE security hardening guide with Pulumi. Private clusters, Workload Identity, Binary Authorization, network policies, IAM configuration, and runtime security enforcement.
testing3
gke-cluster-configuration
Private GKE cluster setup, Workload Identity, and Shielded Nodes with Binary Authorization using Terraform.
devops3
runtime-security
Pod Security Standards and admission controllers for GKE. Runtime monitoring with Falco and behavioral analysis to detect anomalous workload activity.
testing3
runner-group-management
Runner group organization strategies for GitHub Actions. Repository access restrictions, workflow controls, and security boundaries for self-hosted runners.
testing3
network-security
Secure GKE networking with VPC-native IP allocation, zero-trust network policies, Private Service Connect endpoints, and Cloud Armor DDoS protection layers.
development3
oidc-federation-patterns
Secretless authentication to cloud providers using OpenID Connect federation. GCP, Azure, and cloud-agnostic examples with subject claim patterns and trust policies.
development3
self-hosted-runner-hardening
Comprehensive hardening steps for self-hosted GitHub Actions runners. OS-level security, network isolation, credential protection, and audit logging.
testing3
security-scanning-workflows
Comprehensive security scanning examples with SAST (CodeQL), dependency scanning, container vulnerability detection (Trivy), and SARIF upload to GitHub Security tab.
development3
secret-management-overview
Understanding GitHub Actions secret types, storage hierarchy, and threat model. Secure patterns for managing credentials, tokens, and sensitive configuration.
data-ai3
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
testing3
secret-rotation-patterns
Automated secret rotation for GitHub Actions. Schedule recommendations, zero-downtime strategies, and notification patterns for credential lifecycle management.
tools3
secret-scanning-integration
GitHub secret scanning configuration, push protection, custom pattern definitions, and response playbook for detected credentials in GitHub Actions workflows.
tools3
workload-identity-federation-implementation
Workload Identity Federation implementation guide. GKE setup, IAM bindings, ServiceAccount configuration, migration from service account keys, and troubleshooting patterns.
documentation3
workflow-trigger-security
Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.
development3
argo-events
Build event-driven Kubernetes automation with Argo Events. Connect external systems to reactive workflows using EventSources, EventBus, and Sensors.
tools
error-handling-patterns
Master when to fail fast vs degrade gracefully. Production-tested error handling strategies for GitHub Actions, CI/CD pipelines, and platform automation.
tools
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
testing
go-cli-architecture
Build Kubernetes-native CLIs in Go with type safety, testability, and complex orchestration logic for deployment tools and cluster automation.
tools
modular-release-pipelines
Automate version management and changelog generation with smart builds. Only build changed components using GitHub App tokens and release-please integration.
development
versioned-documentation
Deploy version-tagged documentation alongside releases using MkDocs Material, mike, and release-please for automated version alignment with software builds.
development
required-status-checks
CI/CD pipelines as merge gates. Tests, security scans, and linting must pass before code reaches production. Automated validation that satisfies auditors.
development
efficiency-patterns
Optimize automation with idempotency and work avoidance. Safe retries plus skipping unnecessary operations maximize efficiency in CI/CD and platform engineering.
tools
implementation-roadmap
Phased rollout plan for SDLC hardening. Foundation to runtime enforcement in 90 days. Prioritized by risk and audit importance.
testing
architecture-patterns
Fundamental patterns for building maintainable, scalable systems: separation of concerns, distributed orchestration, and zero-downtime migration strategies.
development
argo-workflows-patterns
Production Argo Workflows patterns: reusable templates, error handling, concurrency control, composition, and scheduled automation for Kubernetes operators.
tools
branch-protection-enforcement-patterns
Comprehensive branch protection configuration patterns with enforcement automation. Security tiers, IaC at scale, GitHub App enforcement, audit reporting, and bypass controls.
tools
github-core-app-setup
Configure organization-level GitHub Apps for secure cross-repository automation. Machine identity, audit trails, and enterprise-grade authentication.
tools
open-source-project-templates
Production-ready templates for CONTRIBUTING.md, SECURITY.md, and GitHub issue forms. OpenSSF Best Practices Badge compliant, copy-paste ready, with realistic SLAs.
testing
openssf-scorecard-achievement-guide
Complete OpenSSF Scorecard achievement guide. Understand all 18 security checks, fix false positives, navigate controversial recommendations, and progress from 7 to 10/10.
testing
go-security-tooling
Standard Go security toolkit: race detector, golangci-lint, Trivy, govulncheck. Zero cost, seamless integration, and OpenSSF-certified security workflow patterns.
tools