Architecture Decisions
Architecture Decision Records capturing the why behind key choices.
- ADR 0001: Attestation-Preserving Digest Promotion
- ADR 0002: Declare SLSA Build Level 3 via Isolated Reusable Signing Workflow
- ADR 0003: SBOM Format — CycloneDX 1.6 Primary + SPDX 2.3/3.0 Export via OCI Referrers
- ADR 0004: Admission-Time Attestation Verification via Kyverno ImageValidatingPolicy
- ADR 0005: AI Provenance via git-creep Trailers Injected into SLSA externalParameters
- ADR 0006: DORA Instrumentation — Deployment Definition and Five-Event Pipeline
- ADR 0007: GitHub Flow with Artifact-Promotion Branching Policy
- ADR 0008: Syft + Grype as Security Toolchain; Pin All Security Tooling by Digest
Discussion
Comments are powered by GitHub Discussions. Sign in with GitHub to ask a question or share how this applies in your org.