Build a Practical Security and Supply-Chain Checks Example in Continuous Integration and Delivery

Define the build target

For Security and Supply-Chain Checks, create a small pipeline that installs locked dependencies, runs tests, builds a versioned artifact, performs one security/config check, and publishes only after all gates pass. Build the boundary case using this implementation lens: Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence.

Keep the Security and Supply-Chain Checks build centered on these technical constraints: Trigger/stages and isolated jobs. Locked dependencies and cache. Apply them through this path lens: Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence. Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence.

Implement the core behavior

Implement Security and Supply-Chain Checks around the module artifact—a working security and supply-chain checks exercise with a documented technical result—and keep the implementation specific to this path context: Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence.

name: verify
on: [push, pull_request]
jobs:
  test-and-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: {python-version: '3.13'}
      - run: python -m pip install -r requirements.txt
      - run: python -m pytest
      - run: python -m build
      - uses: actions/upload-artifact@v4
        with:
          name: app-${{ github.sha }}
          path: dist/

Push the branch or run the workflow in a disposable repository

Tests must pass before a versioned build artifact tied to the commit SHA is uploaded.

practice/\n├── README.md\n├── security-and-supply-chain-checks-build.yml\n└── evidence/\n    └── expected-result.txt

Run the complete path

Run one realistic Security and Supply-Chain Checks case end to end and record the required evidence: the module-specific command, output, test, rendered state, query result, log, or measurement that proves the exercise worked. Interpret the result through this path context: Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence.

Change one meaningful condition

Modify one condition central to Security and Supply-Chain Checks using this path context: Use pipeline triggers, build/test jobs, dependency caches, signed/versioned artifacts, supply-chain checks, deployment strategies, configuration changes, monitoring, rollback, and recovery evidence. Predict the new result before rerunning the same workflow.

Verify the artifact

Your deliverable is a working security and supply-chain checks exercise with a documented technical result.

Common mistakes to avoid

• Floating dependency changes build result.
• Artifact rebuilt differently per environment.
• Migration runs after incompatible app switch.
• Secret printed in pipeline log.