supply-chain
6 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
supply-chain/components-licensed | warning | Enough of the components the bill of materials lists name a licence that the inventory can answer what the artifact may be distributed under. |
supply-chain/disallowed-components | error | No component the bill of materials lists is one the team has decided it will not ship, whatever brought it in. |
supply-chain/disallowed-licenses | error | No component the bill of materials lists is licensed under one of the licences the team has decided it will not ship. |
supply-chain/no-critical-vulnerabilities | error | No dependency the build takes on carries an open finding at or above the severity the team gates on. |
supply-chain/sbom-present | error | An SBOM was produced for this build, so the components that went into the artifact are recorded rather than reconstructed later. |
supply-chain/sbom-standard-format | warning | The bill of materials is written in a format anything else can read, and it declares which version of that format it is. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.