enterprise-readiness

分类: 运维与交付 | 上传者: netresearch | 下载: 0 | 版本: v1.0（最新）

Use when evaluating projects for production readiness, implementing supply chain security (SLSA, signing, SBOMs), hardening CI/CD pipelines, establishing quality gates, or pursuing OpenSSF Best Practices Badge.

更新日志: Source: GitHub https://github.com/netresearch/enterprise-readiness-skill

目录结构

当前层级: skills/enterprise-readiness/

📁 references/
- 📄 2fa-enforcement.md 6.4 KB
- 📄 badge-display.md 7.5 KB
- 📄 badge-submission-api.md 13.8 KB
- 📄 badges-and-workflows.md 1.1 KB
- 📄 branch-coverage.md 9.2 KB
- 📄 ci-patterns.md 12.8 KB
- 📄 code-review.md 7.5 KB
- 📄 cve-workflow.md 1.2 KB
- 📄 dco-implementation.md 4.2 KB
- 📄 documentation.md 7.6 KB
- 📄 dynamic-analysis.md 10.0 KB
- 📄 general.md 9.5 KB
- 📄 github.md 19.3 KB
- 📄 go.md 7.1 KB
- 📄 mandatory-requirements.md 6.6 KB
- 📄 openssf-badge-baseline.md 6.4 KB
- 📄 openssf-badge-gold.md 11.2 KB
- 📄 openssf-badge-silver.md 13.8 KB
- 📄 quick-start-guide.md 4.8 KB
- 📄 reproducible-builds.md 5.4 KB
- 📄 scorecard-playbook.md 5.8 KB
- 📄 security-hardening.md 12.3 KB
- 📄 signed-releases.md 4.9 KB
- 📄 slsa-provenance.md 8.6 KB
- 📄 solo-maintainer-guide.md 8.8 KB
- 📄 sonarcloud.md 9.5 KB
- 📄 test-invocation.md 8.3 KB
📁 scripts/
- 📄 add-spdx-headers.sh 2.9 KB
- 📄 analyze-bus-factor.sh 3.1 KB
- 📄 check-branch-coverage.sh 4.3 KB
- 📄 check-coverage-threshold.sh 2.1 KB
- 📄 check-tls-minimum.sh 5.9 KB
- 📄 submit-badges.py 9.6 KB
- 📄 verify-badge-criteria.sh 5.2 KB
- 📄 verify-reproducible-build.sh 3.6 KB
- 📄 verify-review-requirements.sh 5.6 KB
- 📄 verify-signed-tags.sh 3.7 KB
- 📄 verify-spdx-headers.sh 3.0 KB
📄 checkpoints.yaml 3.7 KB
📄 SKILL.md 3.4 KB

SKILL.md

---
name: enterprise-readiness
description: "Use when evaluating projects for production readiness, implementing supply chain security (SLSA, signing, SBOMs), hardening CI/CD pipelines, establishing quality gates, or pursuing OpenSSF Best Practices Badge."
---

# Enterprise Readiness Assessment

## When to Use

- Evaluating projects for production/enterprise readiness
- Implementing supply chain security (SLSA, signing, SBOMs)
- Hardening CI/CD pipelines
- Establishing quality gates
- Pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold)
- Pursuing OpenSSF OSPS Baseline levels (1/2/3)
- Reviewing code or PRs for quality
- Writing ADRs, changelogs, or migration guides
- Configuring Git hooks or CI pipelines

## Quick Reference

Required badges: CI Status, Codecov, OpenSSF Scorecard, Best Practices, Baseline.
Required workflows: `ci.yml`, `codeql.yml`, `scorecard.yml`, `dependency-review.yml`.
See `references/badges-and-workflows.md` for URL patterns and Scorecard quick wins.

## Assessment Workflow

1. **Discovery**: Identify platform, languages, existing CI/CD
2. **Scoring**: Apply checklists from references based on stack
3. **Badge Assessment**: Check OpenSSF criteria status
4. **Gap Analysis**: List missing controls by severity
5. **Implementation**: Apply fixes using scripts and templates
6. **Verification**: Re-score and compare

## References

| Reference | When to Load |
|-----------|--------------|
| `references/badges-and-workflows.md` | Badge URLs, workflow list, Scorecard quick wins |
| `references/general.md` | Always (universal checks) |
| `references/github.md` | GitHub-hosted projects |
| `references/go.md` | Go projects |
| `references/mandatory-requirements.md` | Badge/workflow/Codecov setup checklist |
| `references/scorecard-playbook.md` | Raising Scorecard ~6.8 to ~9.0 |
| `references/cve-workflow.md` | CVE triage and response |
| `references/code-review.md` | PR quality checks |
| `references/documentation.md` | ADRs, changelogs, migration guides |
| `references/ci-patterns.md` | CI/CD pipelines, Git hooks |
| `references/openssf-badge-silver.md` | Silver badge criteria |
| `references/openssf-badge-gold.md` | Gold badge criteria |
| `references/openssf-badge-baseline.md` | OSPS Baseline levels 1/2/3 |
| `references/badge-submission-api.md` | Programmatic badge data submission gotchas |
| `references/slsa-provenance.md` | SLSA Level 3 implementation |
| `references/signed-releases.md` | Cosign/GPG signing |
| `references/solo-maintainer-guide.md` | N/A criteria justification |

## Scripts & Templates

| Directory | Contents |
|-----------|----------|
| `scripts/` | Badge verification, coverage checks, SPDX headers, signed tag verification |

## Critical Rules

- **NEVER** interpolate `${{ github.event.* }}` in `run:` blocks (script injection)
- **NEVER** guess action versions -- always fetch from GitHub API
- **ALWAYS** use SHA pins for actions with version comments
- **ALWAYS** verify commit hashes against official tags
- **ALWAYS** include `https://` URLs in badge justification text (platform rejects criteria without URLs)
- **NEVER** URL-decode session cookies when submitting badge data (breaks authentication silently)

## Related Skills

| Skill | Purpose |
|-------|---------|
| `go-development` | Go code patterns, testing |
| `github-project` | Repository setup, branch protection |
| `security-audit` | Deep security audits (OWASP, XXE, SQLi) |
| `git-workflow` | Git branching, commits, PR workflows |

登录后下载/点赞/收藏 ❤ 2 | ★ 0

enterprise-readiness

目录结构

SKILL.md

举报内容

提示