What are the cheapest ways to mitigate supply chain software risks when using open-source dependencies in our CI CD pipelines?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What are the cheapest ways to mitigate supply chain software risks when using open-source dependencies in our CI CD pipelines?
1 real search · 1 real-search pass
OpenSSF Scorecard documentation dependency pinning GitHub Actions security best practices SLSA provenance SBOM Syft Grype OSV-ScannerGoogle ↗
OBSERVEDInstruction
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
ChatGPT real searches (1)
Classes come from the query-classifier (a local Laya model). 1 of 1 calls are low-confidence (under 50%) — hover a query in the table to see its confidence.
Searches and sources
ChatGPT1 real searches · gpt-6
OpenSSF Scorecard documentation dependency pinning GitHub Actions security best practices SLSA provenance SBOM Syft Grype OSV-Scanner Google ↗
- Documentation · google.github.io
- Documentation · owasp.org
- Documentation · trivy.dev
- Documentation · docs.renovatebot.com
- Syft documentation · github.com
- CycloneDX · cyclonedx.org
- SPDX · spdx.dev
- Exporting a software bill of materials for your repository · docs.github.com
- ENISA Technical Advisory for Secure Use of Package Managers · enisa.europa.eu
- scorecard/docs/checks.md at main · ossf/scorecard · github.com
- Repository Hardening · owasp.github.io
- Documentation · docs.sigstore.dev
- Documentation · slsa.dev
- Documentation · in-toto.io
- OpenSSF Scorecard · scorecard.dev
- GitHub repository · github.com