Supply Chain GitHub Repositories (2026) · Open Source Tools

Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts

poutine, a supply chain vulnerability scanner for build pipelines

Endo is a distributed secure JavaScript sandbox, based on SES

Go implementation of The Update Framework (TUF)

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Software Supply Chain Transparency Log

Software Supply Chain Security Platform

Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.

GUAC aggregates software security metadata into a high fidelity graph database.

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

A CI/CD Red Team Framework for demonstrating Build Pipeline security risks.

Supply chain security for ML

FOSSLight Hub : Integrated management web-service for Open Source Compliance Process

Predicts how news-driven supply-chain shocks ripple across S&P 500 stocks, with an event-study backtest and a hash-chained public prediction ledger. Built on MIT open-source SEC supply-graph code.

Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.

ReARM - Release Governance Platform