odoo-image-supply-chain
Hardens Odoo container pipelines through automated registry builds and security gate enforcement.
Install
mkdir -p .claude/skills/odoo-image-supply-chain && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/17974" && unzip -o skill.zip -d .claude/skills/odoo-image-supply-chain && rm skill.zipInstalls to .claude/skills/odoo-image-supply-chain
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Close container image supply-chain gap with automated ACR builds, vulnerability scanning, and image signingKey capabilities
- →Automate Azure Container Registry (ACR) builds on Git push.
- →Enable vulnerability scanning for container images using Microsoft Defender for Containers.
- →Implement image signing for supply-chain integrity using Notation (CNCF).
- →Document the build-scan-sign-deploy pipeline in a runbook.
- →Update ACR entries with scanning metadata.
How it works
The skill inspects existing Dockerfiles and ACR definitions, queries Microsoft Learn for relevant documentation, compares current practices with desired state, and patches infrastructure to automate builds, scanning, and signing.
Inputs & outputs
When to use odoo-image-supply-chain
- →Automate odoo container build
- →Enable container vulnerability scanning
- →Sign docker images
- →Prepare for security review
About this skill
odoo-image-supply-chain
Impact tier: P1 -- Operational Readiness
Purpose
Close the container image supply-chain gap. The benchmark audit found: no ACR build pipeline, no vulnerability scanning on container images, no image signing, and no provenance trail from Dockerfile to deployed image. The Odoo container image is built locally or ad-hoc and pushed to ACR without automated gates.
When to Use
- Setting up automated container image builds for Odoo.
- Adding vulnerability scanning to the container pipeline.
- Implementing image signing for supply-chain integrity.
- Preparing for a security review of the deployment pipeline.
Required Evidence (inspect these repo paths first)
| Path | What to look for |
|---|---|
infra/azure/main.bicep | ACR resource definition |
infra/ssot/azure/resources.yaml | ACR entries (cripaidev, ipaiodoodevacr) |
infra/ssot/azure/service-matrix.yaml | Odoo service -- image reference |
docs/runbooks/ODOO18_GO_LIVE_CHECKLIST.md | Image build/scan line items |
docs/audits/ODOO_AZURE_ENTERPRISE_BENCHMARK.md | Supply chain gap row |
Docker files in repo root or docker/ | Dockerfile(s) for Odoo image |
Microsoft Learn MCP Usage
Run at least these three queries:
microsoft_docs_search("Azure Container Registry ACR Tasks automated build")-- retrieves ACR Tasks for automated image builds on git push.microsoft_docs_search("Azure Container Registry vulnerability scanning Defender")-- retrieves Microsoft Defender for Containers image scanning.microsoft_docs_search("Azure Container Registry image signing notation")-- retrieves Notation (CNCF) image signing with ACR.
Optional:
microsoft_code_sample_search("ACR task build push yaml", language="yaml")microsoft_docs_fetch("https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-build-task")
Workflow
- Inspect repo -- Locate all Dockerfiles. Check ACR Bicep definitions.
Determine current build process (manual
docker build+az acr login+docker push, or ACR Tasks, or CI pipeline). - Query MCP -- Run the three searches. Capture ACR Tasks YAML syntax, Defender scanning enablement, Notation signing workflow.
- Compare -- Identify: (a) Is there an automated build trigger? (b) Is scanning enabled on ACR? (c) Is image signing in place? (d) Is there a provenance record linking git SHA to image tag?
- Patch -- Create or update:
- ACR Task definition (YAML or Bicep) that builds on push to
main. - Enable Defender for Containers on the ACR (Bicep property or CLI).
- Add image tag convention:
<acr>.azurecr.io/odoo:19.0-<git-sha-short>. - Document the build-scan-sign-deploy pipeline in a runbook.
- ACR Task definition (YAML or Bicep) that builds on push to
- Verify -- ACR Task definition is syntactically valid. Defender scanning property is set. Image tag convention is documented. Runbook exists.
Outputs
| File | Change |
|---|---|
infra/azure/modules/acr.bicep | ACR with Defender scanning enabled |
infra/azure/acr-task.yaml | ACR Task for automated builds (new) |
docs/runbooks/ODOO_IMAGE_BUILD_PIPELINE.md | Build-scan-deploy procedure (new) |
docs/runbooks/ODOO18_GO_LIVE_CHECKLIST.md | Image supply chain line items |
infra/ssot/azure/resources.yaml | ACR entries updated with scanning metadata |
docs/evidence/<stamp>/odoo-image-supply-chain/ | ACR Task def, MCP excerpts |
Completion Criteria
- ACR Task or CI pipeline exists that builds Odoo image on push to
main. - Image tags include the git SHA (e.g.,
19.0-abc1234). - Defender for Containers is enabled on at least one ACR.
- A runbook documents the full build-scan-deploy pipeline.
- Go-live checklist includes image scanning verification.
- Evidence directory contains the ACR Task definition and MCP excerpts.
When not to use it
- →When the user does not want to close container image supply-chain gaps.
- →When the user wants to build Odoo container images locally or ad-hoc.
- →When the user wants to skip vulnerability scanning or image signing.
Limitations
- →The skill focuses on Odoo container images.
- →The skill uses Azure Container Registry (ACR).
- →The skill requires specific evidence paths in the repository.
How it compares
This skill provides a structured workflow to automate and secure the Odoo container image supply chain, integrating specific Azure services and documentation, unlike manual or ad-hoc image management.
Compared to similar skills
odoo-image-supply-chain side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| odoo-image-supply-chain (this skill) | 0 | 3mo | No flags | Advanced |
| secrets-management | 5 | 3mo | Review | Advanced |
| supply_chain_security | 0 | 4mo | Review | Intermediate |
| azure-infra-review | 0 | 3mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Insightpulseai
View all by Insightpulseai →You might also like
secrets-management
wshobson
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
supply_chain_security
zerAda
Docker image signing (Cosign), SBOM generation, SLSA provenance attestation, GHCR registry management.
azure-infra-review
aldelar
Reviews Bicep modules, azure.yaml, and infrastructure changes for the KB Agent project. Checks naming, RBAC, module wiring, and doc sync. Use when working on infra/ or reviewing infrastructure PRs.
container-security-testing
Ed1s0nZ
容器安全测试的专业技能和方法论
sca-trivy
rohunj
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license compliance risks. Use when: (1) Scanning container images and filesystems for vulnerabilities and misconfigurations, (2) Analyzing dependencies for known CVEs across multiple languages (Go, Python, Node.js, Java, etc.), (3) Detecting IaC security issues in Terraform, Kubernetes, Dockerfile, (4) Integrating vulnerability scanning into CI/CD pipelines with SARIF output, (5) Generating Software Bill of Materials (SBOM) in CycloneDX or SPDX format, (6) Prioritizing remediation by CVSS score and exploitability.
security-automation
Ed1s0nZ
安全自动化的专业技能和方法论