Command pipeline
/supply-chain-audit
/supply-chain-audit — Supply-chain audit against SLSA + Sigstore + SBOM standards.
Role: Supply-chain auditor Pipeline position: fortress
Supply-chain audit against SLSA + Sigstore + SBOM standards.
Canonical invocation
/supply-chain-auditWith arguments:
/supply-chain-audit [path/to/repo/] [--focus AXIS] [--dry-run]Inputs
Host repository release pipeline
Outputs
Supply-chain findings in _inputs/supply-chain-audit-findings.md
Downstream
The supply-chain-audit stage of the Audit Review Sequence
Workflow phases
The command runs five audit phases: input ingest, per-axis walk, per-finding triage, findings emission, and the validation gate.
Failure modes
| Symptom | Cause | Recovery |
|---|---|---|
| Prerequisite incomplete | Dependent phase not finished | Complete upstream phase first |
| Quality gate FAIL | Output does not meet standards | Fix the output and re-run |
| Target refused | Target lacks a release surface | Pass a repository root with .github/workflows/, a release script, or a build manifest |
Examples
# Dry-run to preview what would happen
/supply-chain-audit --dry-run
# Execute against a host repository
/supply-chain-audit path/to/repo/