name: Supply Chain Policy

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  repository-policy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify immutable image references and secret hygiene
        run: make verify-supply-chain
      - name: Verify release process is documented
        run: test -s docs/SUPPLY-CHAIN.md