Secure SDLC and Supply Chain Plan

This plan stages the change-control, secure-development, and supply-chain controls needed for CM, SA, SI, and SR families. The goal is to make every production change reviewed, tested, scanned, attributable, and reproducible.

Change Flow

1. Engineer opens a pull request.
2. Required checks run.
3. Non-author reviewer approves.
4. Security-sensitive code receives CODEOWNERS review.
5. Build creates artifacts, scan reports, SBOM, and provenance.
6. Release is promoted through GitOps.
7. Argo CD sync history records production change.
8. Evidence is retained for ConMon.

Required Gates

Gate	Tooling	Blocks Release	Evidence
Typecheck	pnpm typecheck	Yes	CI log
Unit tests	Vitest	Yes	Test report
E2E or story tests	Playwright or Storybook tests where applicable	Conditional	Test report
SAST	CodeQL and Semgrep candidate	Yes for high-confidence high findings	SARIF
Secret scan	gitleaks or TruffleHog candidate	Yes	Scan report
Dependency scan	Dependabot, OSV-Scanner, Trivy, or Grype	Yes by severity policy	Advisory and scan report
Container scan	Trivy or Grype	Yes by severity policy	Image scan report
IaC scan	Checkov, Trivy, or Conftest	Yes for production-impacting findings	Scan report
SBOM	Syft	Yes for release	CycloneDX or SPDX SBOM
Artifact signing	cosign	Yes for release	Signature and certificate
Provenance	SLSA generator	Yes for release	Attestation

Repository Controls

Control	Required Setting	Evidence
Branch protection	Pull request required, status checks required, stale approvals dismissed.	GitHub branch protection export
CODEOWNERS	Security, platform, and data-sensitive paths require owners.	CODEOWNERS file and review history
Admin bypass	Disabled or tightly controlled.	Repository settings export
Secrets	Stored in secret manager or GitHub encrypted secrets, never in code.	Secret scan and configuration export
Actions	Pinned actions or reviewed allowlist for production workflows.	Workflow review and policy export
Environments	Production uses environment protection and approval.	GitHub environment settings

Supply Chain Artifacts

Artifact	Format	Producer	Consumer
SBOM	CycloneDX or SPDX	Syft	Vulnerability management, incident response, 3PAO
Vulnerability report	SARIF, JSON, or native scanner output	Trivy, Grype, OSV-Scanner	Security and POA&M
Provenance	in-toto or SLSA attestation	SLSA generator	Deployment admission, audit
Signature	Sigstore bundle or registry signature	cosign	Admission policy and release verification
Release manifest	Markdown, JSON, or GitHub release metadata	CI/CD	ConMon and rollback

Kubernetes Admission

Policy	Purpose	Candidate Tool	Evidence
Trusted registry only	Blocks unapproved image sources.	Kyverno	Policy report
Signed image required	Blocks unsigned production images.	Kyverno plus cosign verification	Admission result
No privileged containers	Enforces workload hardening.	Kyverno	Policy report
Required labels	Supports inventory and ownership.	Kyverno	Policy report
Resource requests and limits	Reduces availability risk.	Kyverno	Policy report
Network policy required	Enforces segmentation.	Kyverno	Policy report

Secure Coding Expectations

Area	Standard	Evidence
Input validation	Validate external input with Zod or typed API contracts.	Tests and code review
Authorization	Enforce authorization server-side for every protected action.	Tests and code review
Output handling	Encode output by context and avoid unsafe HTML.	Tests and code review
Secrets	No secrets in source, logs, or test fixtures.	Secret scan
Cryptography	Use vetted libraries and approved modes only.	Security review
Logging	Log security events without leaking sensitive data.	Audit event tests
Errors	Return safe errors to users and detailed diagnostics only to logs.	Tests and code review

Release Definition of Done

• Required checks pass.
• Release has SBOM.
• Release has signed artifact.
• Release has provenance.
• Critical and high findings are remediated or approved through risk process.
• Deployment is recorded by Argo CD.
• Rollback path is documented.
• Evidence is available for the monthly ConMon package.