Supply Chain Security Lab

Level:Intermediate

Time:2-3 hours

Cost:low

Works locally:Yes

Cloud creds:No

Cleanup:Yes

Reviewed:2026-05-30

Validation:make validate

Docker Trivy Sbom Cosign GitHub Actions

Overview

Local and CI-based container supply-chain security lab for students.

What You Will Build

Outcome Passing pipeline run plus scan/deploy evidence

Tools used Docker, Trivy, Sbom, Cosign, GitHub Actions

Best fit Intermediate - 2-3 hours

Architecture Diagram

Student workstation Repository files CI/CD pipeline Reference architecture Validation proof

Prerequisites

• Install or review: Docker, Trivy, Sbom, Cosign, GitHub Actions.
• No cloud provider credentials are required by the project metadata.
• This project can be practiced locally before you publish portfolio evidence.
• Open the safety guide before running commands that create infrastructure.

Credentials And Cost Warning

Cost and credential stance

Cost risk is low. Cloud target: no cloud provider. Cloud credentials needed: No. Always use your own account, never commit secrets, and confirm cleanup before creating paid infrastructure.

Step-By-Step Lab

Use this flow before you run commands:

1. Read the cost and credential warning above.
2. Review the validation, troubleshooting, cleanup, and portfolio proof sections below.
3. Follow the original project guide preserved near the bottom of this page.
4. Return to the validation and cleanup checks before you capture portfolio evidence.

Validation Checks

Run the project validation command before and after meaningful changes:

make validate

Troubleshooting

• Run make validate first so local tooling issues are visible early.
• If a command fails, check tool versions, working directory, and required environment variables.
• For pipeline failures, check repository secrets, runner permissions, and pinned action versions.

Cleanup

Cleanup is available or expected for this lab. Use the cleanup or destroy steps in the guide below, then confirm that local clusters, containers, cloud resources, buckets, state files, and CI secrets are no longer active.

Portfolio Proof

• Validation command output: make validate
• Screenshot or terminal proof: Passing pipeline run plus scan/deploy evidence
• Notes explaining what changed, what failed, and how you fixed it
• Cleanup evidence, especially for cloud or Kubernetes resources

Original Project Guide

The original README content is preserved here for lab-specific commands and context. Headings are intentionally demoted so the page outline stays focused on the standard lab flow.

External image reference Level

External image reference Cost

External image reference Security

External image reference CI

Student-friendly lab for learning image scanning, SBOM generation, and image signing concepts with GitHub Actions, Trivy, Syft, and Cosign.

What You Learn

• How container images move through a security pipeline
• How to scan for vulnerabilities and secrets
• How to generate an SBOM
• Why image signing matters
• How CI gates protect deployments

Architecture

flowchart LR
  Code["Node demo app"] --> Image["Docker image"]
  Image --> Trivy["Trivy vulnerability scan"]
  Image --> Syft["Syft SBOM"]
  Image --> Cosign["Cosign signing optional"]
  Trivy --> Gate["CI security gate"]
  Syft --> Artifact["SBOM artifact"]

Prerequisites

• Node.js for local syntax validation
• Docker
• Trivy for vulnerability scanning
• Syft for SBOM generation
• Cosign, optional for signing

One-Command Local Workflow

make validate
make up
make logs
make scan
make down

make up builds the local image and runs it at http://localhost:8080.

Beginner Local Flow

docker build -t supply-chain-demo:local ./app
trivy image --severity HIGH,CRITICAL supply-chain-demo:local
syft supply-chain-demo:local -o spdx-json > sbom.spdx.json

Optional signing flow:

cosign generate-key-pair
cosign sign --key cosign.key supply-chain-demo:local

Validation

make validate

This runs node --check app/server.js and parses the GitHub Actions workflow when PyYAML is installed.

CI Flow

The sample workflow in .github/workflows/security.yml builds the image, scans it, and writes an SBOM artifact.

Troubleshooting

• trivy: command not found: install Trivy, or run only make validate and make up for the beginner path.
• syft: command not found: install Syft before generating sbom.spdx.json.
• Docker cannot connect: start Docker Desktop or your local Docker engine.
• Signing a local image fails: push to a registry first, or use the signing step as a concept exercise.

Cleanup

make down
rm -f sbom.spdx.json cosign.key cosign.pub

Student Exercises

• Add a vulnerable dependency and watch Trivy fail.
• Add .trivyignore with a documented exception.
• Push the image to GHCR.
• Sign the GHCR image with keyless Cosign.

Source Files On GitHub

Use the guide first.

The full learning flow stays on this page. Open GitHub only when a step asks you to inspect code, fork the lab, or download source assets.

Read safety guide Open project source