Secure GitOps Supply Chain

A locally runnable delivery platform showing how a small application moves through security gates, immutable image publication, SBOM generation, keyless signing, Git-based promotion, Argo CD reconciliation, and Kyverno admission control.

The reference workload is deliberately modest—FastAPI, an unprivileged Nginx frontend, and PostgreSQL—so the platform and its evidence remain the focus.

What this proves

• Pull requests lint, test, build, scan, and generate a source SBOM without registry or cluster write access.
• releases publish commit-addressed GHCR images, build provenance, SPDX SBOMs, Trivy results, Cosign signatures, and checksummed evidence manifests;
• promotion and rollback create reviewable Git pull requests; CI never runs kubectl against staging or production;
• Argo CD continuously reconciles three declarative Kustomize environments;
• Pod Security Standards and Kyverno reject root, unbounded, mutable, unapproved, or unverifiable workloads;
• pull-request previews run in disposable, per-PR kind clusters and always collect cleanup evidence;
• Prometheus/Grafana expose application, deployment, and Argo CD reconciliation health.

This repository does not claim a SLSA level. Build provenance and signed evidence are present, but the project has not demonstrated every requirement of a SLSA maturity level.

Ten-minute local demonstration

Prerequisites are Docker, Python 3.12+, GNU Make, curl, tar, unzip, and Linux amd64. The tool bootstrap downloads pinned binaries and verifies their SHA-256 checksums.

make doctor
make verify
make tools
make tofu-validate render
make cluster-up
make deploy-local
make smoke-k8s
make policy-test
make evidence-test promotion-test rollback-test

The application is available at http://localhost:8081. Add live admission enforcement with:

make bootstrap-policies
make policy-live-test

Install Argo CD after the branch is available from GitHub:

make bootstrap-argocd
kubectl --kubeconfig .local/sgsc-local.kubeconfig \
  -n argocd port-forward service/argo-cd-argocd-server 8080:80

Finally remove the explicitly confirmed disposable cluster:

make cluster-down CONFIRM=sgsc-local

Common commands

Command	Result
make compose-up smoke-compose	Runs the complete app without Kubernetes
make verify	Formatting, lint, strict types, tests, coverage
make workflow-lint security-scan	Workflow syntax, dependency, secret, and IaC gates
make sbom IMAGE=<reference>	SPDX JSON SBOM plus checksum under ignored artifacts/
make policy-test	Three safe/unsafe Kyverno policy pairs
make promotion-test rollback-test	Evidence binding and Git-state recovery proofs
make bootstrap-monitoring	Pinned Prometheus/Grafana stack (optional, resource-heavy)

Repository map

• app/ — API, frontend, PostgreSQL wrapper, tests, and reproducible containers.
• .github/workflows/ — CI, release, promotion, rollback, and preview workflows.
• platform/bootstrap/ — OpenTofu-managed disposable kind cluster.
• platform/argocd/ — restricted project and environment applications.
• platform/policies/ — Kyverno security, resource, registry, digest, and signature controls.
• platform/monitoring/ — Prometheus/Grafana values, monitors, and dashboard.
• environments/ — hardened development, staging, and production-like overlays.
• evidence/ — release evidence schema; generated evidence stays ignored.
• tests/ — smoke, integration, admission, promotion, and rollback proofs.
• docs/ — architecture, threat model, supply chain, demo, and runbooks.

Security boundaries

No private signing key, registry token, kubeconfig, cloud credential, OpenTofu state, or generated secret is committed. Local signing keys are encrypted and written under ignored .local/. Staging and production credentials must come from an external secret manager or an operator-created Secret; Git stores only references.

Start with the architecture, the threat model, and the demonstration script. Honest operational constraints are listed in limitations.