Concepts
Explanation-quadrant essays on the principles behind attested delivery.
- The Digest Is the Release
- GitHub Flow over Git-Flow, and What the Release Candidate Actually Is
- Attestations That Survive Promotion
- Enforce at Admission, Not by Convention
- SLSA Build Level 3 Is Nearly Free
- An SBOM You Can Actually Use
- Supply-Chain Hazards That Got Real in 2026
- Honest DORA: Define a Deployment First
- Recording AI Authorship in Provenance
- Observability for a Delivery Pipeline, Not Just the App
- Verify Every External Fetch
Discussion
Comments are powered by GitHub Discussions. Sign in with GitHub to ask a question or share how this applies in your org.