SkillsAdd

netresearch/enterprise-readiness-skill · Archived

enterprise-readiness

Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.

First seen Mar 11, 2026

Installation

$ npx skills add netresearch/enterprise-readiness-skill --skill enterprise-readiness
View on skills.sh ↗ GitHub repository ↗

Summary

Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.

Stronger alternatives

This repository is archived — consider an actively maintained alternative.

azure-enterprise-infra-planner Similar · more installs
microsoft/azure-skills

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud a…

402.8K installs
firebase-firestore-enterprise-native-mode Similar · more installs
firebase/agent-skills 36.1K installs
gtm-enterprise-account-planning Similar · more installs
github/awesome-copilot

Strategic account planning and execution for enterprise deals. Use when planning complex sales …

1.6K installs
gtm-enterprise-onboarding Similar · more installs
github/awesome-copilot

Four-phase framework for onboarding enterprise customers from contract to value realization. Us…

1.6K installs

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

enterprise-readiness Linked neighbor
dirnbauer/webconsulting-skills

Use when evaluating projects for production or enterprise readiness, implementing supply chain …

50 installs
frontend-design Same topic
anthropics/skills

Guidance for distinctive, intentional visual design when building new UI or reshaping an existi…

866.4K installs
agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
vercel-react-best-practices Same topic
vercel-labs/agent-skills 697.8K installs
web-design-guidelines Same topic
vercel-labs/agent-skills

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…

617.3K installs
microsoft-foundry Same topic
microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …

576.5K installs
More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 4
License LICENSE-CC-BY-SA-4.0
Default branch main
Open issues 2
Status Archived

Skill metadata

Parsed from SKILL.md frontmatter.

Version4.17.3
License(MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0
CompatibilityRequires gh CLI, python3, cosign, docker.
Allowed toolsBash(${CLAUDE_SKILL_DIR}/scripts/*) Bash(bash ${CLAUDE_SKILL_DIR}/scripts/*) Bash(gh:*) Bash(cosign:*) Read Write Glob Grep
More metadata
author
Netresearch DTT GmbH
version
4.17.3
repository
https://github.com/netresearch/enterprise-readiness-skill

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 4,336 B
  • docs SUMMARY.md 439 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 67 installs

SKILL.md

Enterprise Readiness Assessment

Production/enterprise tier only — see references/tier-framing.md.

When to Use

  • Production/enterprise readiness evaluations
  • Supply chain security: SLSA provenance, cosign signing, SBOMs
  • CI/CD hardening, workflow permissions
  • OpenSSF Best Practices (Passing/Silver/Gold), OSPS Baseline (L1/2/3)
  • Scorecard optimization (Token-Permissions, Branch-Protection, Pinned-Deps)
  • Code review, ADRs, changelogs, SECURITY.md

Assessment Workflow

  1. Discovery: Identify platform, languages, existing CI/CD, dependabot.yml
  2. Scoring: Apply checklists; check Scorecard, badge criteria, coverage
  3. Gap Analysis: List missing controls by severity
  4. Implementation: Apply fixes (SHA-pin actions, harden permissions, add workflows)
  5. Verification: Re-score and compare

Mandatory Workflows & Badges

Required coverage: CI, CodeQL, Scorecard, dependency review, composer audit, SBOM — as dedicated workflows or jobs calling the netresearch reusable. Badges: CI, Codecov, Scorecard, Best Practices, Baseline. See references/badges-and-workflows.md.

Key Hardening Patterns

  • Permissions: Declare permissions: contents: read at workflow-level; grant write only per-job
  • SHA pinning: Third-party actions pinned to SHA with version comment (# v4.2.0). Org-internal reusable workflows use @main
  • Harden-Runner: step-security/harden-runner as first step in every job; prefer egress-policy: block with allowed-endpoints
  • Dependabot: Configure dependabot.yml with all ecosystems (composer, npm, github-actions, docker); set up auto-merge workflow for dependency PRs using pullrequesttarget
  • Coverage: Upload via codecov-action; configure codecov.yml with patch coverage threshold
  • Duplicate CI prevention: Scope push: trigger to branches: [main] when pull_request: is also present
  • SLSA provenance: Use actions/attest-build-provenance with id-token: write and attestations: write permissions; verify with gh attestation verify
  • Security policy: Create SECURITY.md with vulnerability disclosure process and response SLA (Critical: 7 days, High: 30 days)

Critical Rules

  • NEVER interpolate ${{ github.event. }} or ${{ inputs. }} in run: blocks (script injection)
  • NEVER guess action versions -- fetch from GitHub API and verify SHA against tags
  • ALWAYS include https:// URLs in badge justifications
  • ALWAYS configure auto-merge for repos with Dependabot/Renovate

References

Reference Use
references/general.md Always
references/scorecard-playbook.md Scorecard optimization
references/badges-and-workflows.md Badge URLs, workflows
references/mandatory-requirements.md Checklist
references/ci-patterns.md CI/CD, hooks
references/code-review.md PR quality
references/slsa-provenance.md SLSA Level 3
references/signed-releases.md Cosign/GPG
references/openssf-badge-silver.md Silver
references/openssf-badge-gold.md Gold
references/openssf-badge-baseline.md OSPS Baseline
references/harden-runner-guide.md Harden-Runner
references/solo-maintainer-guide.md N/A criteria
references/npm-pnpm-supply-chain.md pnpm
references/python-pip-supply-chain.md pip

Related skills: go-development, github-project, security-audit, git-workflow.