agentsclimarketplace
Sign in

Enterprise readiness

Skill netresearch/enterprise-readiness-skill/skills/enterprise-readiness

Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.From its SKILL.md

Install
npx -y skills add netresearch/enterprise-readiness-skill --skill enterprise-readiness

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as (MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

4.1 KB, 867 tokens by cl100k_base, as published. Nobody here has run it

Enterprise Readiness Assessment

Production/enterprise tier only — see references/tier-framing.md.

When to Use

  • Production/enterprise readiness evaluations
  • Supply chain security: SLSA provenance, cosign signing, SBOMs
  • CI/CD hardening, workflow permissions
  • OpenSSF Best Practices (Passing/Silver/Gold), OSPS Baseline (L1/2/3)
  • Scorecard optimization (Token-Permissions, Branch-Protection, Pinned-Deps)
  • Code review, ADRs, changelogs, SECURITY.md

Assessment Workflow

  1. Discovery: Identify platform, languages, existing CI/CD, dependabot.yml
  2. Scoring: Apply checklists; check Scorecard, badge criteria, coverage
  3. Gap Analysis: List missing controls by severity
  4. Implementation: Apply fixes (SHA-pin actions, harden permissions, add workflows)
  5. Verification: Re-score and compare

Mandatory Workflows & Badges

Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.

Key Hardening Patterns

  • Permissions: Declare permissions: contents: read at workflow-level; grant write only per-job
  • SHA pinning: Third-party actions pinned to SHA with version comment (# v4.2.0). Org-internal reusable workflows use @main
  • Harden-Runner: step-security/harden-runner as first step in every job; prefer egress-policy: block with allowed-endpoints
  • Dependabot: Configure dependabot.yml with all ecosystems (composer, npm, github-actions, docker); set up auto-merge workflow for dependency PRs using pull_request_target
  • Coverage: Upload via codecov-action; configure codecov.yml with patch coverage threshold
  • Duplicate CI prevention: Scope push: trigger to branches: [main] when pull_request: is also present
  • SLSA provenance: Use actions/attest-build-provenance with id-token: write and attestations: write permissions; verify with gh attestation verify
  • Security policy: Create SECURITY.md with vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)

Critical Rules

  • NEVER interpolate ${{ github.event.* }} or ${{ inputs.* }} in run: blocks (script injection)
  • NEVER guess action versions -- fetch from GitHub API and verify SHA against tags
  • ALWAYS include https:// URLs in badge justifications
  • ALWAYS configure auto-merge for repos with Dependabot/Renovate

References

ReferenceUse
references/general.mdAlways
references/scorecard-playbook.mdScorecard optimization
references/badges-and-workflows.mdBadge URLs, workflows
references/mandatory-requirements.mdChecklist
references/ci-patterns.mdCI/CD, hooks
references/code-review.mdPR quality
references/slsa-provenance.mdSLSA Level 3
references/signed-releases.mdCosign/GPG
references/openssf-badge-silver.mdSilver
references/openssf-badge-gold.mdGold
references/openssf-badge-baseline.mdOSPS Baseline
references/harden-runner-guide.mdHarden-Runner
references/solo-maintainer-guide.mdN/A criteria
references/npm-pnpm-supply-chain.mdpnpm

Related skills: go-development, github-project, security-audit, git-workflow.

What ships with it: 44 files

361.2 KB alongside SKILL.md, 11 of them executable

evals/

references/

scripts/

4 more files not listed here. See all 44 in the repository.

Keep looking

Skills are one crate of 326,871. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.