Use when evaluating projects for production readiness, implementing supply chain security (SLSA, signing, SBOMs), hardening CI/CD pipelines, establishing quality gates, or pursuing OpenSSF Best Practices Badge.
Production/enterprise tier only — see
references/tier-framing.md.
Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.
permissions: contents: read at workflow-level; grant write only per-job# v4.2.0). Org-internal reusable workflows use @mainstep-security/harden-runner as first step in every job; prefer egress-policy: block with allowed-endpointsdependabot.yml with all ecosystems (composer, npm, github-actions, docker); set up auto-merge workflow for dependency PRs using pull_request_targetcodecov-action; configure codecov.yml with patch coverage thresholdpush: trigger to branches: [main] when pull_request: is also presentactions/attest-build-provenance with id-token: write and attestations: write permissions; verify with gh attestation verifySECURITY.md with vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)${{ github.event.* }} or ${{ inputs.* }} in run: blocks (script injection)https:// URLs in badge justifications| Reference | Use |
|-----------|-----|
| references/general.md | Always |
| references/scorecard-playbook.md | Scorecard optimization |
| references/badges-and-workflows.md | Badge URLs, workflows |
| references/mandatory-requirements.md | Checklist |
| references/ci-patterns.md | CI/CD, hooks |
| references/code-review.md | PR quality |
| references/slsa-provenance.md | SLSA Level 3 |
| references/signed-releases.md | Cosign/GPG |
| references/openssf-badge-silver.md | Silver |
| references/openssf-badge-gold.md | Gold |
| references/openssf-badge-baseline.md | OSPS Baseline |
| references/harden-runner-guide.md | Harden-Runner |
| references/solo-maintainer-guide.md | N/A criteria |
| references/npm-pnpm-supply-chain.md | pnpm |
| references/python-pip-supply-chain.md | pip |
Related skills: go-development, github-project, security-audit, git-workflow.
npx skills add netresearch/enterprise-readiness下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer