Add build provenance and image verification skill and prompt

promptbook/prompts.json

@@ -799,6 +799,26 @@
       ],
       "formatNotes": "All three. Point the tool at the manifests folder, the CI workflow that deploys it, and any per-environment values files. Copilot: kustomize path instructions plus those files in agent mode (or save it as `.github/prompts/scaffold-kustomize-aks-overlays.prompt.md`). Claude Code: the kustomize-aks-overlay-guardrails skill plus the files. Codex: AGENTS.md Kubernetes manifests section, then the diff.",
       "body": "Task: Set up or clean up Kustomize manifests for the service I specify so each environment is a small overlay on one base, every overlay renders and validates in CI, and reviewers see the rendered diff. Finish with a minimal diff, the CI job, and a rendered-output comparison.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Manifests root: {{K8S_PATH}}  (e.g. deploy/k8s)\n- Environments and clusters: {{ENVS}}  (e.g. dev, stage, prod on AKS; namespace per env)\n- Kubernetes versions: {{K8S_VERSIONS}}  (per cluster)\n- Image registry and tagging: {{IMAGES}}  (e.g. ACR, digest pinned by CI)\n- Config and secrets: {{CONFIG}}  (which values differ per env; where secrets live, e.g. Azure Key Vault)\n- Identity: {{IDENTITY}}  (e.g. AKS workload identity client ID per env)\n- Optional pieces: {{COMPONENTS}}  (e.g. monitoring annotations, PodDisruptionBudget, topology spread for prod)\n- CI system: {{CI}}  (GitHub Actions | Azure Pipelines | Jenkins)\n- Tool versions: {{TOOLS}}  (kustomize, kubeconform, kube-linter or policy tool)\n\nRequirements:\n\n1. Map the current state\n   - Table: overlay | what it changes from base | cluster and namespace | deprecated fields | copied base resources | secrets in Git\n   - Render every overlay as it is today with the pinned kustomize version and save the output for comparison\n\n2. Modernize\n   - Replace `bases`, `commonLabels`, `patchesStrategicMerge`, `patchesJson6902`, and `vars` with `resources`, `labels`, `patches`, and `replacements` (`kustomize edit fix` first, then hand-check)\n   - Rendered output must match the saved output, or list and justify every difference\n\n3. Structure\n   - `base/` environment-neutral; `components/` for {{COMPONENTS}}; `overlays/<env>/` with only real differences\n   - Strategic merge patches for values; JSON 6902 patches with explicit targets for list edits (`args`, `command`, env lists without a merge key) and removals\n   - Small, named patch files; no overlay copies a full base resource\n\n4. Labels and selectors\n   - Stable identity labels in base selectors; extra labels via `labels:` with `includeSelectors: false`\n   - Flag any change that would alter an existing Deployment or StatefulSet selector and stop for confirmation instead of applying it\n\n5. Images and config\n   - Images set with the `images:` field in each overlay; prod pinned to a digest or immutable tag; no `latest` in any rendered output\n   - ConfigMaps from `configMapGenerator` with hash suffixes on; document any `disableNameSuffixHash`\n\n6. Secrets and identity\n   - No secret values or committed secret files; use a SecretProviderClass for Azure Key Vault through the Secrets Store CSI driver with workload identity from {{IDENTITY}}\n   - List any secret that was committed in history so it can be rotated\n\n7. CI gate in {{CI}}\n   - For each overlay: build with pinned kustomize, fail on warnings; kubeconform strict against {{K8S_VERSIONS}} with CRD schemas; policy check with the pinned tool\n   - On pull requests, render each overlay on the base and head branches and publish the diff as a comment or artifact\n   - Pin every tool version and action\n\nConstraints:\n- Minimal diff. Don't change resource requests, replicas, probes, or app config values unless a finding requires it; report findings instead.\n- Don't apply anything to a cluster. `kubectl diff -k` against non-production is the most you suggest running.\n- Don't invent cluster names, versions, IDs, or digests; use placeholders and state assumptions.\n- Don't add Helm, and don't enable Helm inflation inside Kustomize.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete diffs and a checklist.\n\nOutput format:\n1. Current-state table with flagged issues\n2. New directory tree\n3. Patch (kustomization files, patches, components, generators, SecretProviderClass, CI job)\n4. Rendered-output comparison per overlay: identical, or each difference with its reason\n5. Risk list (selector changes, secrets to rotate, version gaps) and follow-ups\n\nStart from {{K8S_PATH}}. Render before you refactor, and prove the rendered output is unchanged unless you meant to change it.\n"
+    },
+    {
+      "id": "add-build-provenance-and-image-verification",
+      "title": "Add Build Provenance, SBOM Attestations, and Deploy-Time Verification",
+      "whenToUse": "Add signed provenance and SBOM attestations to a GitHub Actions release pipeline, verify them with an exact repo, workflow, and ref identity before every AKS deploy, promote images by digest with their attestations, and stage admission enforcement audit-first, with negative tests that prove unsigned or foreign images are rejected.",
+      "tools": [
+        "copilot",
+        "claude-code",
+        "codex"
+      ],
+      "tags": [
+        "supply-chain",
+        "slsa",
+        "github-actions",
+        "aks",
+        "devsecops",
+        "security"
+      ],
+      "formatNotes": "All three. Point the tool at the release and deploy workflows, the Dockerfile, the manifests or overlays that reference the image, and any existing cluster policies. Copilot: supply-chain path instructions plus those files in agent mode (or save it as `.github/prompts/add-build-provenance-and-image-verification.prompt.md`). Claude Code: the artifact-provenance-signing-guardrails skill plus the files. Codex: AGENTS.md release and supply chain section, then the diff.",
+      "body": "Task: Add signed build provenance and SBOM attestations to the release pipeline for the artifacts I specify, verify them with an exact identity before every deploy, and stage admission enforcement on AKS. Finish with a minimal diff, a verification runbook, and negative tests.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Artifacts: {{ARTIFACTS}}  (e.g. container image app-api, Spring Boot JAR, CLI binary)\n- Registries: {{REGISTRIES}}  (e.g. dev ACR and prod ACR, or GHCR)\n- Release workflow: {{RELEASE_WORKFLOW}}  (e.g. .github/workflows/release.yml; trigger such as tag v* or push to main)\n- Deploy path: {{DEPLOY}}  (e.g. GitHub Actions deploy job with Kustomize overlay, or GitOps repo)\n- Repo visibility and plan: {{VISIBILITY}}  (public, or private on GitHub Enterprise Cloud)\n- Runners: {{RUNNERS}}  (GitHub-hosted or self-hosted)\n- Target SLSA build level: {{SLSA_LEVEL}}  (L2 or L3)\n- SBOM format and tool: {{SBOM}}  (e.g. CycloneDX via syft, or the CycloneDX Maven plugin)\n- Admission option: {{ADMISSION}}  (Kyverno verifyImages, Ratify with Gatekeeper and Azure Policy, or none yet)\n- Signing requirement: {{SIGNING}}  (keyless via actions/attest, or Notation with a Key Vault certificate)\n\nRequirements:\n\n1. Map the current state\n   - Table: artifact | built by (workflow/job) | pushed to | how deploy selects it (tag or digest) | signed or attested today | verified where\n   - Flag mutable-tag deploys, stored signing keys, broad workflow permissions, unpinned actions, and attestations from untrusted triggers\n\n2. Attest\n   - Capture the digest from the build step output; attest `name@digest`, never a tag\n   - Add `actions/attest` (SHA-pinned) for provenance and a second call with `sbom-path` for the SBOM, both with `push-to-registry: true`\n   - Job-level permissions only on the attest job: `id-token: write`, `attestations: write`, `artifact-metadata: write`, plus registry write (`packages: write` for GHCR, or OIDC login with AcrPush for ACR)\n   - No attestation on pull_request, fork, or `pull_request_target` runs\n   - If {{SIGNING}} is Notation: sign through the Azure Key Vault plugin after OIDC login; no key material in secrets\n\n3. Builder isolation for {{SLSA_LEVEL}}\n   - L2: GitHub-hosted runners and the steps above\n   - L3: move build and attest into a reusable workflow that callers can't modify; callers pass inputs only\n   - Say plainly which level the result supports and why; don't overclaim with self-hosted runners\n\n4. Verify before deploy\n   - In {{DEPLOY}}: `gh attestation verify oci://<image>@<digest> --repo <owner>/<repo> --signer-workflow <path> --source-ref <ref>`; add `--deny-self-hosted-runners` when builds are hosted; verify the SBOM attestation with `--predicate-type`\n   - Fail closed: no retry loop, no skip input, no `continue-on-error`\n   - Pass the verified digest into the manifest or overlay; the deployed spec must reference the digest\n   - Private repos: document the trusted-root step for any verifier outside gh, and offline verification with `--bundle` if needed\n\n5. Promotion\n   - Promote by digest without rebuilding; copy referrers with the image (for example `oras cp -r`), or verify in the source and re-attest in the target\n   - Re-verify in the target registry before the prod deploy\n\n6. Admission on AKS ({{ADMISSION}})\n   - Policy that checks signatures or attestations for {{REGISTRIES}} with an identity matching the release workflow\n   - Ship in audit mode first; list how to read violations; enforce on app namespaces only after a clean audit window\n   - Narrow, documented exemptions with owner and expiry; explicit webhook timeout and failure policy\n   - Note that AKS Image Integrity is preview, Notation-only, and audit-only, if it is under consideration\n\n7. Negative tests\n   - An unsigned image, an image attested by a different workflow, and a tag swapped after verification: each must fail in the pipeline and be flagged or blocked at admission\n\nConstraints:\n- Minimal diff. Don't change build steps, tests, scanners, or app code beyond what attestation and verification need.\n- Never add signing keys, tokens, or certificates to the repo or to plain secrets; never print OIDC tokens.\n- Don't apply admission policies to a cluster. Provide the manifests and the commands for a non-production dry run.\n- Don't invent registry names, workflow paths, digests, or tenant IDs; use placeholders and state assumptions.\n- Treat provenance as origin proof only; keep CVE and license gates as they are.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete diffs and a checklist.\n\nOutput format:\n1. Current-state table with flagged issues\n2. Patch (release workflow, reusable workflow if L3, deploy verification step, promotion step, admission policy in audit mode)\n3. Permission matrix per job\n4. Verification runbook: exact commands for a developer, for CI, and for an incident responder checking a running pod's image\n5. Negative test plan and expected results\n6. Risks, SLSA level actually achieved, and follow-ups\n\nStart from {{RELEASE_WORKFLOW}}. Capture the digest first, verify before you deploy, and audit before you enforce.\n"
     }
   ]
 }