release-securitylisted

# Skill: release-security ## Premise A built container image is a **supply-chain artifact**, not just a deploy blob. The build→registry gate has four jobs the pack references everywhere but executes nowhere: **scan** the image for OS/library CVEs, **generate an SBOM**, **sign** the digest, and **attest provenance** — then **verify** at deploy. This skill is the executor that closes that loop (the security pack's `@security-auditor` A03 check *dispatches here*; `dockerfile-lint` stops at hadolint; `deps-audit` scans the manifest, not the image's OS layer). **Every finding cites the image + the CVE id (or the missing gate) + the fix.** "Image looks insecure" without the cited CVE/digest is not a finding. This is a runner — it executes the tools and gates the pipeline on the result. ## What this covers vs siblings - `deps-audit` (security pack) — **application dependencies** from the lockfile. This skill — **the image OS packages + baked libraries** trivy/grype see that `deps-audit` cannot. - `dockerfile-lint` (devops) — the **Dockerfile** (non-root, multi-stage, pinned base). This skill — the **built image** and its **signature/SBOM/provenance**. ## Prerequisites - `trivy` (or `grype`) for image CVE scan; `syft` for SBOM; `cosign` for signing/attestation. - A registry the image is pushed to (sign the digest there). - **Keyless signing via OIDC** (Fulcio/Rekor) preferred over a long-lived cosign key — no key to leak; identity = the CI workload. ## Procedure 1. **Image C