How does this roadmap avoid disrupting developer workflows?

The skill utilizes a phased approach, starting with non-blocking foundation steps and evidence collection in Month 1 before moving to strict enforcement in the final month.

Is this roadmap specific to GitHub?

While the core principles apply generally, the specific implementation tasks and validation scripts are optimized for GitHub repositories and GitHub Actions.

What security tools does this skill help implement?

It provides implementation patterns for TruffleHog (secrets detection), Trivy/Grype (vulnerability scanning), Syft (SBOM generation), and Kyverno (policy-as-code).

Can this skill help with audit preparation?

Yes, it includes specific tasks for setting up GCS evidence archives and running audit simulation scripts to identify gaps before a real audit occurs.

SDLC Security Implementation Roadmap

Name: SDLC Security Implementation Roadmap
Author: adaptive-enforcement-lab

byadaptive-enforcement-lab

0•

Security & Testing

Guides a 90-day phased rollout of secure software development lifecycle controls and automated enforcement patterns.

The Implementation Roadmap skill provides a structured, 12-week framework for hardening your development environment without disrupting existing workflows. It guides Claude through a three-month transition—starting with foundational branch protections and CI/CD checks, moving into secrets detection and SBOM generation, and concluding with policy-as-code and audit readiness. This skill is ideal for engineering teams needing to meet compliance standards or improve their security posture through prioritized, risk-based automation and evidence collection.

Key Features

0112-week phased security rollout schedule with weekly tasks

02Security tool integration for TruffleHog, Trivy, and Kyverno

03Automated branch protection and CI/CD status check configuration

04Transition guides for migrating from PATs to GitHub Apps

050 GitHub stars

06Automated evidence collection workflows for audit compliance

Use Cases

01Establishing a Policy-as-Code framework for Kubernetes deployments

02Hardening a repository to meet SOC2 or ISO 27001 audit requirements

03Migrating a team from manual security reviews to automated enforcement gates

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add adaptive-enforcement-lab/claude-skills implementation-roadmap

For use in Claude.ai and ChatGPT

Download Skill