<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Supply Chain Incident Response — API Reference

## SBOM Generation (Syft)

```bash
# Generate CycloneDX SBOM from container image
syft packages registry.company.com/app:latest -o cyclonedx-json > sbom.json

# Generate from directory
syft packages dir:/app -o spdx-json > sbom-spdx.json

# Generate from archive
syft packages /evidence/container.tar -o cyclonedx-json > sbom.json
```

## Vulnerability Scanning (Grype)

```bash
# Scan SBOM for vulnerabilities
grype sbom:sbom.json --output json > vulns.json

# Scan image directly
grype registry.company.com/app:latest --only-fixed

# Filter by severity
grype sbom:sbom.json --fail-on critical
```

## Package Manager Auditing

### npm

```bash
npm audit --json
npm ls compromised-pkg
npm view compromised-pkg time --json
npm pack compromised-pkg@1.2.3
```

### pip

```bash
pip-audit --format json
pip show compromised-pkg
pip download compromised-pkg==1.2.3 --no-deps -d /evidence/
```

## Artifact Verification

### cosign — Verify Image Signature

```bash
cosign verify --key cosign.pub registry.company.com/app:latest
```

### SLSA Verifier — Check Provenance

```bash
slsa-verifier verify-image registry.company.com/app:latest \
  --source-uri github.com/company/app \
  --source-tag v1.2.3
```

## GitHub API — CI/CD Audit

```bash
# List recent workflow runs
gh run list --repo company/app --limit 50 --json conclusion,headBranch,updatedAt

# Audit workflow file changes
git log --oneline --diff-filter=M -- .github/workflows/

# List repository secrets (names only)
gh api repos/company/app/actions/secrets --jq '.secrets[].name'
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `-o` | Syft output format | `cyclonedx-json`, `spdx-json` |
| `--fail-on` | Grype severity threshold | `critical` |
| `--only-fixed` | Show only fixable vulns | N/A |
| `--key` | cosign verification key | `cosign.pub` |
| `--source-uri` | SLSA source repo | `github.com/company/app` |
