Define the boundaries
Set expectations before execution. Human-readable standards and reusable agent skills guide planning, implementation, review, security, QA, and release work.
AI Software Toolkit / standards, skills, and verification
AI is the accelerant.
Assurance is mandatory.
AI turns directives into code faster than ever. Build assurance into the work before changes ship. AI Software Toolkit provides the foundation: clear standards, controlled agent skills, and checks connected to evidence.
Your directives. Disciplined execution. Evidence before release.
Verify the work
Run your build, tests, QA, and scanners against the change. Choose the checks, thresholds, and enforcement that fit your repository’s risks.
Demand evidence before release
Proof binds results to the evaluated revision. Inspect passing checks, failures, and missing evidence before making a release decision.
All toolkit checks are optional to adopt. Installing skills does not run them or make checks required. Your team owns its application, commands, review decisions, and release authority.
Separate decisions · separate checks
Two SDLC checkpoints in practice
A PR review and verification after merge answer different questions. Each checkpoint below has its own check list, revision and evidence. There is no combined score.
Historical examples from ravisingh11/ai-software-toolkit-reference-app. These runs come from different changes. They are fixed teaching examples, not the latest results for the repository shown on this page.
Recorded PR policy evidence · advisory
PR created or updated
Ready for review?
- Invocation
pull_request_target- Tested revision
510e25a6c8f4- Source run started
Four PR checks from the recorded evaluation of reference app PR #63.
- PR title and bodyPassed · advisory
- PR size and change scopeFailed · advisory
- Changed-code coverageUnverified · advisory
- Dependency change reviewPassed · advisory
Next decision
Review the recorded size finding and missing coverage evidence. Inspect fresh results and current merge requirements before deciding to merge.
Inspect this recorded runRecorded workflow observations · main
After merge
Did this main revision pass its adopted verification?
- Invocation
push: refs/heads/main- Tested revision
c3df3f459f14- Source run started
Four Application acceptance steps on main. These are workflow outcomes, not a Proof policy score or live deployment evidence.
- Application buildPassed
- Unit tests and coveragePassed
- Browser acceptancePassed
- Migration validationPassed
Next decision
Inspect evidence for the resulting main revision. Deployment approval and live health/API/UI verification remain separate decisions.
Inspect this recorded runPR findings do not become main results. Main CI does not establish deployment health. These examples never contribute to the live scorecard totals below. Checks remain optional, Core advisory, and lifecycle/polyglot manual.
CI evidence / change assessment
Latest PR Scorecard
Latest published PR results for ravisingh11/ai-software-toolkit-reference-app.
Evaluation stage: Pull-request development. The catalog offers tools to adopt as your project needs them; it is not a checklist every project must complete.
All 33 checks
Explore the full built-in catalog. All checks are optional to adopt. Only selected checks applicable to this evaluation count toward the score.
Selected (16)
Included in this evaluation; selection does not mean passed.
Available to adopt (9)
Optional checks outside this evaluation’s score.
Relevant later (8)
Checks for later stages. Lifecycle verification stays manual.
- Pull request
- #71
- Evaluated commit
- 55f159118b08
- PR base
- 6126f500b4b3
- Policy / runtime
- 6126f500b4b3
- Page renderer
- 6126f500b4b3
- Source evaluation started
Results reflect the checks and policy used for that PR. Updating this page doesn’t rerun checks or verify current main.
ORANGE
Advisory controls need attention
No enforced controls are configured, so the policy decision is not gated by any control and every result is advisory. It does not establish mergeability or release readiness. GitHub required merge checks are separate. Advisory results do not block the toolkit policy decision. Enforced checks require a pass: a failed, blocked, or unverifiable enforced check blocks that decision. GitHub blocks merging only through its configured required checks and rulesets.
- Toolkit policy decision
- ALLOW
- Advisory only
Needs attention
Pull-request checks
- Unable to verify Changed Code Coverage Advisory
- Unable to verify Deep SAST Advisory
- Unable to verify Platform Secret Protection Advisory
- Unable to verify Dependency Remediation Advisory
Selected checks
12/16
checks passed
Unable to verify: 4
Enforced
None
checks enforced
No checks enforced
Advisory
12/16
checks passed
Unable to verify: 4
The totals count 16 selected checks. Of the 33 built-in checks listed below, 16 are selected, 9 available to adopt and 8 relevant later. Only selected checks applicable to this evaluation count toward the totals; adoption options and later-stage checks are excluded. Selection does not mean execution or enforcement. See all checks ↑
Evidence results
| Controls | Passed | Unavailable evidence |
|---|---|---|
| All selected checks | 12 | 4 |
| Advisory | 12 | 4 |
Failed means a reported failure. Blocked means the producer reported a blocker. Unavailable evidence includes not configured, disabled, awaiting manual run, and checks marked Unable to verify; see their separate counts and labels below. Zero-count categories are hidden; a dash means no results in that category. Tools available to adopt and checks relevant later are excluded from this stage’s score. Checks evaluated on another subject are identified separately. Unreported checks have unknown selection and are not assumed excluded.
Stage-specific evaluation
Selected checks
Built-in activation and evidence availability: Unable to verify: 4. Advisory is a policy mode, independent of provider activation. These categories split unavailable evidence for built-in checks; none counts as passed.
These are the checks selected for this evaluation, plus any entries whose selection could not be validated. Adoption options and later-stage checks are listed separately below. Select a check to inspect its evidence. Provider names link to trusted base configuration when its identity is recorded. Latest reported run links open available evidence for this snapshot, not a newer scan. Provider names describe selection, not credential readiness or a passing scan. Not configured means required provider configuration is absent; it does not change the selected policy mode. Not reported means no validated row in this snapshot; it does not imply disabled or passed. A dash means the check has no active mode in this snapshot. Custom controls may contribute to totals without publishing their private names.
Check details
Checks needing attention come first. Source report links open the evaluation run containing the detailed evidence.
Changed Code Coverage changed-code-coverage
Unable to verifyMeasure test coverage for changed code
Provider: Repository Changed Code Coverage Command · Latest reported run ↗
Advisory
Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
Assessment criteria
| Assessment | Coverage of changed code |
|---|---|
| Evaluates | Executable changed lines compared with repository coverage policy |
| Expected result | Changed-line coverage meets the repository-configured threshold |
| Execution time | Not supplied by this source report |
| Counts not reported | Only the overall result was reported. This report does not include covered lines, uncovered lines, coverage percentage, configured threshold. |
Deep SAST deep-sast
Unable to verifyDetect security vulnerabilities through semantic source analysis
Provider: GitHub CodeQL default setup
Advisory
Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
Assessment criteria
| Assessment | Semantic security analysis |
|---|---|
| Evaluates | Data flow and security queries for configured languages |
| Expected result | Selected security analysis satisfies its configured policy |
| Execution time | Not supplied by this source report |
| Counts not reported | Finding counts are not collected for this run. CodeQL and Snyk Code counts appear when their workflows package them; Semgrep App keeps its findings in its own report. Open the provider's report, or GitHub code scanning (the repository's Security tab) for CodeQL, for vulnerabilities by severity. |
Platform Secret Protection platform-secret-protection
Unable to verifyVerify platform secret scanning and push protection
Provider: GitHub Secret Protection · Latest reported run ↗
Advisory
Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
Assessment criteria
| Assessment | Platform protection settings |
|---|---|
| Evaluates | Secret scanning and push protection capability checks |
| Expected result | Required platform protections are enabled and verified |
| Execution time | Not supplied by this source report |
| Counts not reported | Only the overall result was reported. This report does not include secret scanning enabled, push protection enabled. |
Dependency Remediation dependency-remediation
Unable to verifyVerify automated dependency security remediation is configured
Provider: GitHub Dependabot · Latest reported run ↗
Advisory
Missing: verified Dependabot settings evidence for this revision. Check Dependabot Verification and whether SECURITY_SETTINGS_TOKEN can read vulnerability alerts and automated security fix settings. Dependabot may already be enabled even when its verification evidence is missing. This snapshot does not establish the exact cause. This is not a passing result.
Assessment criteria
| Assessment | Remediation configuration |
|---|---|
| Evaluates | Automated dependency security update configuration |
| Expected result | Required dependency remediation automation is configured |
| Execution time | Not supplied by this source report |
| Counts not reported | Only the overall result was reported. This report does not include security updates enabled, configuration checks. |
Repository Validation repository-validation
PassedValidate repository-owned contracts and configuration
Provider: Repository Validators · Latest reported run ↗
Advisory
Ran for 7s · completed
4 passed · 0 failed · 0 not run (4 contract groups)Self-reported by the pull request's own workflow run; not independently verified and never used for the result.
Assessment criteria
| Assessment | Installed Proof contracts |
|---|---|
| Evaluates | Installed runtime files, Semgrep self-test fixtures, schemas, and the control catalog, profiles, providers, and policy |
| Expected result | Every contract group validates; the first failure stops the run |
| Started (UTC) | 2026-10-31T21:49:44Z |
| Completed (UTC) | 2026-10-31T21:49:51Z |
| Execution time | 7s (7 seconds) |
| Producer conclusion | success |
| Self-reported measurements | 4 passed · 0 failed · 0 not run (4 contract groups) |
Documentation Validation documentation-validation
PassedValidate documentation structure, links, and declared targets
Provider: Repository Validators · Latest reported run ↗
Advisory
Ran for 8s · completed
56 Markdown files · 136 local links checked · 0 broken · 0 documentation mapping failuresSelf-reported by the pull request's own workflow run; not independently verified and never used for the result.
Assessment criteria
| Assessment | Documentation integrity |
|---|---|
| Evaluates | Local Markdown links, declared documentation targets, and required documentation updates for changed files |
| Expected result | No broken local links and every documentation mapping is satisfied |
| Started (UTC) | 2026-10-31T21:49:25Z |
| Completed (UTC) | 2026-10-31T21:49:33Z |
| Execution time | 8s (8 seconds) |
| Producer conclusion | success |
| Self-reported measurements | 56 Markdown files · 136 local links checked · 0 broken · 0 documentation mapping failures |
Repository Ground Truth repository-ground-truth
PassedValidate declared repository architecture and engineering documents
Provider: Repository Validators · Latest reported run ↗
Advisory
Ran for 12s · completed
1 of 1 declared documents found · 0 missingSelf-reported by the pull request's own workflow run; not independently verified and never used for the result.
Assessment criteria
| Assessment | Declared engineering ground truth |
|---|---|
| Evaluates | Documents declared in .proof/ground-truth-ai.yaml, such as agent instructions and architecture, testing, security, and contribution guides |
| Expected result | Every declared document exists in the repository; document contents are not assessed |
| Started (UTC) | 2026-10-31T21:49:34Z |
| Completed (UTC) | 2026-10-31T21:49:46Z |
| Execution time | 12s (12 seconds) |
| Producer conclusion | success |
| Self-reported measurements | 1 of 1 declared documents found · 0 missing |
PR Size change-scope
PassedDetect oversized or unexpectedly broad changes
Provider: PR Size / Files & LOC · Latest reported run ↗
Advisory
Ran for 0s · completed
Assessment criteria
| Assessment | Change size |
|---|---|
| Evaluates | Counted files, added lines, changed lines, and maximum additions per file |
| Expected result | Each measurement is within its configured limit |
| Started (UTC) | 2026-10-31T21:49:20Z |
| Completed (UTC) | 2026-10-31T21:49:20Z |
| Execution time | 0s (0 seconds) |
| Producer conclusion | success |
Files & lines of code
Large PRs can overwhelm human reviewers; smaller, focused PRs make feedback more actionable.
Exceeding a limit warns only; it does not block the policy decision.
| Measurement | Counted | Limit | Result |
|---|---|---|---|
| Counted files | 1 | 12 | Within limit |
| Added lines | 1 | 300 | Within limit |
| Added + deleted lines | 2 | 500 | Within limit |
| Most added lines in one file | 1 | 150 | Within limit |
Total diff
1 files · 1 added lines · 2 added + deleted lines
Excluded from limits
0 files · 0 added lines · 0 added + deleted lines
Counted changes exclude the configured path patterns. Binary files: 0 counted; 0 excluded. Binary contents have no line count. File paths are not published.
PR Metadata pr-metadata
PassedValidate pull-request title and body requirements against mutable PR state
Provider: Repository PR Metadata · Latest reported run ↗
Advisory
Title matches the required format · No required sections configuredEvaluated by the trusted base-branch PR metadata validator. The title, description, and section names are not published.
Assessment criteria
| Assessment | PR title and description |
|---|---|
| Evaluates | Configured title pattern and required description sections; title and description text are not published |
| Expected result | Title matches the configured pattern and every required section is present |
| Execution time | Not supplied by this source report |
| Evaluated | Title matches the required format · No required sections configured |
Format and Lint format-and-lint
PassedVerify repository formatting and lint rules with the repository-owned command
Provider: Repository Format and Lint Command · Latest reported run ↗
Advisory
Ran for 40s · completed
Assessment criteria
| Assessment | Formatting and lint rules |
|---|---|
| Evaluates | Repository-configured formatter and lint command |
| Expected result | Configured command completes successfully |
| Started (UTC) | 2026-10-31T21:49:18Z |
| Completed (UTC) | 2026-10-31T21:49:58Z |
| Execution time | 40s (40 seconds) |
| Producer conclusion | success |
| Counts not reported | Only the command's exit status is reported. This repository supplies the command, so counts such as files checked, errors, warnings depend on its tools; open the source report for their output. |
Migration Validation migration-validation
PassedValidate repository-specific database and data migration safety
Provider: Repository Migration Validation Command · Latest reported run ↗
Advisory
Ran for 48s · completed
Assessment criteria
| Assessment | Migration safety |
|---|---|
| Evaluates | Repository-specific migration checks, or declared absence of migrations |
| Expected result | Repository migration validator succeeds |
| Started (UTC) | 2026-10-31T21:49:24Z |
| Completed (UTC) | 2026-10-31T21:50:12Z |
| Execution time | 48s (48 seconds) |
| Producer conclusion | success |
| Counts not reported | Only the overall result was reported. This report does not include migrations checked, failed. |
Build build
PassedDetect compilation, packaging, and build-time regressions
Provider: Repository Build Command · Latest reported run ↗
Advisory
Ran for 41s · completed
Assessment criteria
| Assessment | Build and packaging |
|---|---|
| Evaluates | Repository-configured build command |
| Expected result | Build command completes successfully |
| Started (UTC) | 2026-10-31T21:49:23Z |
| Completed (UTC) | 2026-10-31T21:50:04Z |
| Execution time | 41s (41 seconds) |
| Producer conclusion | success |
| Counts not reported | Only the command's exit status is reported. This repository supplies the command, so counts such as artifacts produced, build errors depend on its tools; open the source report for their output. |
Unit Tests unit-tests
PassedDetect functional regressions in changed behavior
Provider: Repository Unit Test Command · Latest reported run ↗
Advisory
Ran for 29s · completed
Assessment criteria
| Assessment | Automated unit tests |
|---|---|
| Evaluates | Repository-configured test command and selected test suites |
| Expected result | Test command completes successfully |
| Started (UTC) | 2026-10-31T21:49:02Z |
| Completed (UTC) | 2026-10-31T21:49:31Z |
| Execution time | 29s (29 seconds) |
| Producer conclusion | success |
| Counts not reported | Only the overall result was reported. This report does not include tests passed, failed, skipped, total. |
Custom Static Analysis custom-static-analysis
PassedRun repository and organization-specific static rules
Provider: Semgrep Community Edition · Latest reported run ↗
Advisory
Ran for 6m 13s · completed
No findings reportedSelf-reported by the pull request's own workflow run; not independently verified and never used for the result.
Assessment criteria
| Assessment | Custom static rules |
|---|---|
| Evaluates | Repository and organization-specific analysis rules |
| Expected result | Configured analyzer completes without policy-blocking findings |
| Started (UTC) | 2026-10-31T21:50:22Z |
| Completed (UTC) | 2026-10-31T21:56:35Z |
| Execution time | 6m 13s (373 seconds) |
| Producer conclusion | success |
| Self-reported measurements | No findings reported |
Secret Detection secret-detection
PassedDetect credentials and authentication material in source history
Provider: Gitleaks CLI · Latest reported run ↗
Advisory
Ran for 13s · completed
No findings reportedSelf-reported by the pull request's own workflow run; not independently verified and never used for the result.
Assessment criteria
| Assessment | Secrets in source history |
|---|---|
| Evaluates | Credential patterns in the configured scan scope |
| Expected result | Scanner reports no policy-blocking secret findings |
| Started (UTC) | 2026-10-31T21:49:01Z |
| Completed (UTC) | 2026-10-31T21:49:14Z |
| Execution time | 13s (13 seconds) |
| Producer conclusion | success |
| Self-reported measurements | No findings reported |
Dependency Change Review dependency-change-review
PassedReview security and license risk introduced by dependency changes
Provider: GitHub Dependency Review · Latest reported run ↗
Advisory
Ran for 5s · completed
Assessment criteria
| Assessment | Dependency changes |
|---|---|
| Evaluates | New or changed dependencies and associated security/license risk |
| Expected result | Changes satisfy the configured dependency review policy |
| Started (UTC) | 2026-10-31T21:49:16Z |
| Completed (UTC) | 2026-10-31T21:49:21Z |
| Execution time | 5s (5 seconds) |
| Producer conclusion | success |
| Counts not reported | Only the overall result is reported. GitHub Dependency Review writes changed dependencies, new vulnerabilities, and license violations to its own job summary; open the pull request's Dependency Review check for them. |
Tools available to adopt
These tools are excluded from the current score. Adopt them when they fit the project and its evaluation stage; they are not missing requirements.
Static Quality · Dependency Vulnerability · License Compliance · IaC Misconfiguration · Functional QA · AI Engineering Review · AI QA Review · AI Security Review · AI Repository Standards Review
Static Quality static-quality
Available to adoptEvaluate maintainability, reliability, and static quality gates
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: SonarQube
- Add the producer workflow and configure its required inputs or credentials.
- Select
static-qualityasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Dependency Vulnerability dependency-vulnerability
Available to adoptDetect known vulnerabilities in resolved dependencies
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Snyk Open Source
- Add the producer workflow and configure its required inputs or credentials.
- Select
dependency-vulnerabilityasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
License Compliance license-compliance
Available to adoptEvaluate dependency licenses against repository policy
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: FOSSA
- Add the producer workflow and configure its required inputs or credentials.
- Select
license-complianceasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
IaC Misconfiguration iac-misconfiguration
Available to adoptDetect insecure infrastructure-as-code configuration
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Trivy IaC Configuration
- Add the producer workflow and configure its required inputs or credentials.
- Select
iac-misconfigurationasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Functional QA functional-qa
Available to adoptExercise the running application as a user to detect functional regressions in changed behavior
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: QA Bootstrap Workflow
- Add the producer workflow and configure its required inputs or credentials.
- Select
functional-qaasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
AI Engineering Review ai-engineering-review
Available to adoptReview correctness, architecture, maintainability, and regression risk
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Codex Code Review
- Add the producer workflow and configure its required inputs or credentials.
- Select
ai-engineering-reviewasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
AI QA Review ai-qa-review
Available to adoptReview tests, edge cases, failure paths, and assertions
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: AI QA Review Adapter
- Add the producer workflow and configure its required inputs or credentials.
- Select
ai-qa-reviewasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
AI Security Review ai-security-review
Available to adoptReview authentication, isolation, injection, secrets, and privilege risks
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: AI Security Review Adapter
- Add the producer workflow and configure its required inputs or credentials.
- Select
ai-security-reviewasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
AI Repository Standards Review ai-repository-standards-review
Available to adoptReview changes against repository-owned engineering ground truth
Useful during: Pull-request development, when this tool fits your project.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: AI Repository Standards Review Adapter
- Add the producer workflow and configure its required inputs or credentials.
- Select
ai-repository-standards-reviewasadvisoryunderoverrides.changein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Checks relevant later
These tools are excluded from the current score. Adopt them when they fit the project and its evaluation stage; they are not missing requirements.
Artifact Provenance · Runtime Soak · Container Vulnerability · Artifact SBOM · Artifact Vulnerability · Deployment Policy · Dynamic Application Security · Runtime Assurance
Artifact Provenance artifact-provenance
Relevant laterAttest where and how a release artifact was built
Useful during: Release.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: GitHub Artifact Attestations
- Add the producer workflow and configure its required inputs or credentials.
- Select
artifact-provenanceasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Runtime Soak runtime-soak
Relevant laterDetect runtime degradation, leaks, and performance drift over time
Useful during: Pre-release.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Repository Soak Command
- Add the producer workflow and configure its required inputs or credentials.
- Select
runtime-soakasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Container Vulnerability container-vulnerability
Relevant laterDetect vulnerabilities in container images
Useful during: Release.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Trivy Container Image
- Add the producer workflow and configure its required inputs or credentials.
- Select
container-vulnerabilityasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Artifact SBOM artifact-sbom
Relevant laterRecord the software components contained in an artifact
Useful during: Release.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Trivy Artifact SBOM
- Add the producer workflow and configure its required inputs or credentials.
- Select
artifact-sbomasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Artifact Vulnerability artifact-vulnerability
Relevant laterDetect vulnerabilities in a built release artifact
Useful during: Release.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Trivy Artifact Vulnerabilities
- Add the producer workflow and configure its required inputs or credentials.
- Select
artifact-vulnerabilityasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Deployment Policy deployment-policy
Relevant laterVerify deployment approval and environment policy
Useful during: Deployment.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Verification Deployment Policy
- Add the producer workflow and configure its required inputs or credentials.
- Select
deployment-policyasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Dynamic Application Security dynamic-application-security
Relevant laterDetect vulnerabilities in a running application
Useful during: Post-deployment.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: OWASP ZAP Local Baseline
- Add the producer workflow and configure its required inputs or credentials.
- Select
dynamic-application-securityasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Runtime Assurance runtime-assurance
Relevant laterVerify runtime security and operational safeguards
Useful during: Runtime.
Optional; excluded from this stage’s score. No passing or failing result is implied.
Example provider: Verification Runtime Assurance
- Add the producer workflow and configure its required inputs or credentials.
- Select
runtime-assuranceasadvisoryunderoverrides.releasein.proof/policy.yaml. - Run the producer for the matching revision and evaluate its applicable stage. Manual producers remain manual.
Trace it to the evidence
Open the source CI run for the full scorecard, individual controls, and supporting results.
View source CI run- Source run
- #41245328105 · attempt 1
- Source created
- Published
- Operation
- change
Verification details
Subject digestsha256:3616c1568eb99e2a569798d4679d34bd3d3e4d4620f6b5ded9a8816b76ca803a