Pinned Loading

1. supply-chain-secure-build supply-chain-secure-build Public

   End-to-end container supply chain security — SAST (Semgrep CE), SCA (govulncheck), supply-chain risk (Socket), SBOM (Syft), vulnerability gate (Trivy), keyless Cosign signing + SLSA provenance via …

   Go 1

2. kyverno-policy-library kyverno-policy-library Public

   Policy as Code for Kubernetes — tested Kyverno guardrails (non-root, resource limits, read-only rootfs, no SA token, no :latest, no default namespace) enforced at admission and unit-tested with kyv…

   Shell 1

3. terraform-pr-gates terraform-pr-gates Public

   Continuous Integration (CI): Blocking PR quality gates for Terraform — fmt, validate, terraform test (offline mock providers), TFLint, Checkov, Gitleaks — with a sticky results comment on every PR

   1

4. gke-pgbouncer-hardened gke-pgbouncer-hardened Public

   Hardened, highly-available PgBouncer on GKE — Workload Identity, External Secrets Operator + Secret Manager, SCRAM-SHA-256, TLS to Cloud SQL, default-deny NetworkPolicy

   Dockerfile 2

5. k8s-networkpolicy-zero-trust k8s-networkpolicy-zero-trust Public

   Zero-trust NetworkPolicy patterns for Kubernetes/GKE — layered default-deny, Cloudflare-only ingress, SSRF-safe internet egress, Cilium FQDN allowlists

   1

6. teleport-jit-db-access teleport-jit-db-access Public

   Just-in-time, device-bound PostgreSQL access through Teleport, with Slack alerts on risky queries and security events. Terraform + Docker Compose.

   HCL 1