SBOM, a vulnerability scan with a provable blocking gate, keyless signing, and a cluster that rejects unhardened pods — plus the honest story of fighting a Critical CVE I couldn't bump away.

"We do DevSecOps" usually means a scanner runs somewhere and emails a report nobody opens. A control that can't stop a bad artifact isn't a control, it's a dashboard. So I set out to wrap four real supply-chain controls around the small service from the earlier golden-path work, each able to fail the build or block a deploy: an SBOM, a vulnerability scan with a gate that provably blocks, keyless signing, and a cluster policy that rejects anything unhardened.

Then the scanner immediately caught something I couldn't make go away, and that turned out to be the most useful part of the whole exercise. I'll get to it.

Everything runs on free infrastructure, so you can clone it and watch the controls reject things yourself. Repo: github.com/PradeepKandepaneni/golden-path-supplychain.…