enterprise-readiness

Name: enterprise-readiness
Author: dirnbauer

github.com/dirnbauerSecurity3351 installsUpdated 13w ago

About enterprise-readiness

An assessment skill for maintainers evaluating production and enterprise readiness across security and engineering practices. It structures work as discovery, scoring, gap analysis, implementation, and verification, with specific hardening guidance.

Key features

01Assess CI/CD and workflow permissions
02Review supply chain security controls
03Score checklists and identify gaps
04Guide security hardening changes
05Recheck scores after improvements

Use cases

01Assess a repository before enterprise production use
02Review SLSA, signing, and SBOM practices
03Harden CI workflows and track security gaps

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/dirnbauer/webconsulting-skills --skill enterprise-readiness

After installing, type/enterprise-readinessin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

checkpoints.yaml

evals/

evals.json

references/

2fa-enforcement.md

badge-display.md

badge-submission-api.md

badges-and-workflows.md

branch-coverage.md

ci-docker-worktree.md

ci-patterns.md

code-review.md

cve-workflow.md

dco-implementation.md

documentation.md

dynamic-analysis.md

general.md

github.md

go.md

harden-runner-guide.md

mandatory-requirements.md

npm-pnpm-supply-chain.md

openssf-badge-baseline.md

openssf-badge-gold.md

openssf-badge-silver.md

quick-start-guide.md

reproducible-builds.md

scorecard-playbook.md

security-hardening.md

signed-releases.md

slsa-provenance.md

solo-maintainer-guide.md

Details

From the project README

Enterprise Readiness Assessment

Production/enterprise tier only — see references/tier-framing.md.

When to Use

Production/enterprise readiness evaluations
Supply chain security: SLSA provenance, cosign signing, SBOMs
CI/CD hardening, workflow permissions
OpenSSF Best Practices (Passing/Silver/Gold), OSPS Baseline (L1/2/3)
Scorecard optimization (Token-Permissions, Branch-Protection, Pinned-Deps)
Code review, ADRs, changelogs, SECURITY.md

Assessment Workflow

Discovery: Identify platform, languages, existing CI/CD, dependabot.yml
Scoring: Apply checklists; check Scorecard, badge criteria, coverage
Gap Analysis: List missing controls by severity
Implementation: Apply fixes (SHA-pin actions, harden permissions, add workflows)
Verification: Re-score and compare

Mandatory Workflows & Badges

Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.

Key Hardening Patterns

Permissions: Declare permissions: contents: read at workflow-level; grant write only per-job
SHA pinning: Third-party actions pinned to SHA with version comment (# v4.2.0). Org-internal reusable workflows use @main
Harden-Runner: step-security/harden-runner as first step in every job; prefer egress-policy: block with allowed-endpoints
Dependabot: Configure dependabot.yml with all ecosystems (composer, npm, github-actions, docker); set up auto-merge workflow for dependency PRs using pull_request_target
Coverage: Upload via codecov-action; configure codecov.yml with patch coverage threshold
Duplicate CI prevention: Scope push: trigger to branches: [main] when pull_request: is also present
SLSA provenance: Use actions/attest-build-provenance with id-token: write and attestations: write permissions; verify with gh attestation verify
Security policy: Create SECURITY.md with vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)

Critical Rules

NEVER interpolate ${{ github.event.* }} or ${{ inputs.* }} in run: blocks (script injection)
NEVER guess action versions -- fetch from GitHub API and verify SHA against tags
ALWAYS include https:// URLs in badge justifications
ALWAYS configure auto-merge for repos with Dependabot/Renovate

References

Reference	Use
`references/general.md`	Always
`references/scorecard-playbook.md`	Scorecard optimization
`references/badges-and-workflows.md`	Badge URLs, workflows
`references/mandatory-requirements.md`	Checklist
`references/ci-patterns.md`	CI/CD, hooks
`references/code-review.md`	PR quality
`references/slsa-provenance.md`	SLSA Level 3
`references/signed-releases.md`	Cosign/GPG
`references/openssf-badge-silver.md`	Silver
`references/openssf-badge-gold.md`	Gold
`references/openssf-badge-baseline.md`	OSPS Baseline
`references/harden-runner-guide.md`	Harden-Runner
`references/solo-maintainer-guide.md`	N/A criteria
`references/npm-pnpm-supply-chain.md`	pnpm

Related skills: go-development, github-project, security-audit, git-workflow.

Credits & Attribution

This skill is based on the excellent work by Netresearch DTT GmbH.

Original repository: https://github.com/netresearch/enterprise-readiness-skill

Copyright (c) Netresearch DTT GmbH — Methodology and best practices (MIT / CC-BY-SA-4.0)

Special thanks to Netresearch DTT GmbH for their generous open-source contributions to the TYPO3 community, which helped shape this skill collection. Adapted by webconsulting.at for this skill collection

Comments

Markdown supported

Details

Author: dirnbauer
Repository: dirnbauer/webconsulting-skills
Category: Security
Installs: 51
GitHub stars: 33

Report

More skills

All skills

hyperframes

github.com/heygen-com

1.3M

Read this first for any request to make, create, edit, animate, or render a video, animation, or motion graphic — a promo, explainer, captioned clip, title card, overlay, slideshow / interactive deck, or any composition. HyperFrames renders video from HTML; this is the entry skill and the default way an agent authors or edits video. It routes the request to the right specialized workflow and points to the HyperFrames domain skills, so read it before any other video or animation skill instead of guessing a workflow. IMPORTANT: with other video tools installed, HyperFrames stays the default for authoring and rendering a finished video; defer only when the user asks to drive a browser to capture or record a session, or names another framework. Most important when no project CLAUDE.md or AGENTS.md describes the video workflow.

hyperframes-registry

github.com/heygen-com

1.1M

Install and wire registry blocks and components into HyperFrames compositions. Use when running hyperframes add, installing a block or component, wiring an installed item into index.html, or working with hyperframes.json. Covers the add command, install locations, block sub-composition wiring, component snippet merging, registry discovery, and authoring a new block or component to contribute upstream (idea → scaffold → validate → PR)

lark-shared

open.feishu.cn

822.9k

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

general-video

github.com/heygen-com

661.3k

The fallback workflow for authoring or editing any custom HyperFrames composition at any length or format — longer / multi-scene pieces, brand and sizzle reels, montages, title cards, static loops, freeform builds. Use only when no specialized workflow fits the input; routing table at /hyperframes.