We use GitHub and Jira, how do we mitigate supply chain software risks in our CI CD pipelines cheaply?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
We use GitHub and Jira, how do we mitigate supply chain software risks in our CI CD pipelines cheaply?
2 real searches · 1 real-search pass
GitHub documentation secure use reference pinning actions full length commit SHA least privilege GITHUB_TOKEN permissions OIDC dependency review Dependabot code scanning artifact attestationsGoogle ↗
OBSERVED
SLSA official build levels provenance supply chain security CI CD recommendationsGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
GitHub documentation secure use reference pinning actions full length commit SHA least privilege GITHUB_TOKEN permissions OIDC dependency review Dependabot code scanning artifact attestations Google ↗
SLSA official build levels provenance supply chain security CI CD recommendations Google ↗
- docs/content/actions/reference/security/secure-use.md at main · github/docs · github.com
- Secure use reference · docs.github.com
- GitHub Actions policy now supports blocking and SHA pinning actions · github.blog
- slsa/spec/build-track-basics.md at main · slsa-framework/slsa · github.com
- DevSecOpsGuideline/current-version/2-Process/2-3-Build/2-3-6-Supply-Chain-Security/2-3-6-2-Artifact-Signing-and-Provenance.md at master · OWASP/DevSecOpsGuideline · github.com
- slsa/spec/build-provenance.md at main · slsa-framework/slsa · github.com
- GitHub Code Security documentation · docs.github.com
- GitHub Actions security best practices · docs.github.com
- SLSA supply chain security framework · slsa.dev
- OWASP DevSecOps guidelines · owasp.org
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
GitHub documentation secure use reference pinning actions full length commit SHA least privilege GITHUB_TOKEN permissions OIDC dependency review Dependabot code scanning artifact attestations OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
SLSA official build levels provenance supply chain security CI CD recommendations OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |