Docker Scout, SBOMs and Provenance: Securing the CI/CD Supply Chain
9 min read6.8k
Add vulnerability gating, SBOM and provenance attestations, and keyless signing to a GitHub Actions pipeline using Docker Scout, BuildKit and Cosign, with policies that fail the build only when it matters.