Enforce Sbom

Generate SBOM enforcement step YAML

Use only wizard answers. Default: verify SBOM + keyless Harness OIDC + policy sets from Phase 9.

CI / Security — SscaEnforcement (Third-Party Docker):

- step:
    identifier: enforce_sbom
    name: SBOM Policy Enforcement
    type: SscaEnforcement
    spec:
      source:
        type: docker
        spec:
          connector: <docker_registry_connector>
          image: <org>/<repo>:<tag>
      verifyAttestation:
        type: cosign
        spec:
          type: keyless
          spec:
            oidcProvider: harness
      policy:
        policySets:
          - <sbom_policy_set_identifier>
    timeout: 15m

Policy sets only (UI Policy Configuration):

      policy:
        policySets:
          - sbom_license_allowlist
          - sbom_deny_critical

No verification (when user unchecks Verify SBOM):

      policy:
        policySets:
          - <sbom_policy_set_identifier>

Omit verifyAttestation.

Repository source — add overrideConnectorRef on spec (see reference doc).

CD Deployment — use CdSscaEnforcement inside a containerized stepGroup (stepGroupInfra); include spec.infrastructure matching that group (see references/sbom-enforcement-step.md and skills/create-sbom/references/cd-containerized-step-group.md). When adding a new Deploy stage, place enforcement in stepGroup.steps before the deploy step — not at top-level execution.steps.

Source types (docker, ecr, gcr, gar, acr, har, repository) match /create-sbom — see skills/create-sbom/references/sbom-orchestration-step.md for provider-specific source.spec fields.

Full UI mapping: references/sbom-enforcement-step.md.

Insert step into pipeline YAML

• Insert at Phase 3 placement — after generate_sbom / SscaOrchestration when possible.
• Do not modify unrelated steps, variables, or failure strategies.
• Step identifier: enforce_sbom (rename if duplicate).
• CI: same spec.execution.steps list as orchestration.
• CD: inside the containerized step group only.

Update pipeline via MCP

harness_update
  resource_type: pipeline
  resource_id: <pipeline_identifier>
  org_id: <organization>
  project_id: <project>
  body: { yamlPipeline: "<updated pipeline YAML>" }

On validation errors, read the API message, fix fields (often verifyAttestation shape or policy.policySets), retry.

Provide summary

Report the results to the user (same pattern as /configure-repo-scan — do not execute the pipeline):

## SBOM Policy Enforcement Configured

**Pipeline:** <pipeline_name>
**Step:** SBOM Policy Enforcement (SscaEnforcement | CdSscaEnforcement)
**Location:** Stage "<stage_name>", <position>
**Source:** <type> — <connector/registry> — <image or repo>
**Verify attestation:** Keyless (Harness OIDC) — or as configured
**Policy sets:** <list>

**Pipeline URL:** https://app.harness.io/ng/account/<account_id>/module/ci/orgs/<org_id>/projects/<project_id>/pipelines/<pipeline_id>/pipeline-studio/

**Note:** Review the SBOM Policy Enforcement step in Pipeline Studio to adjust Advanced settings.

### Next Steps
1. Run the pipeline via `/run-pipeline` to verify enforcement executes successfully
2. If the run fails, diagnose with `/debug-pipeline`
3. View policy evaluation on the execution **Supply Chain** tab and Artifacts → **Policy Violations**
4. If **Failed** due to policy deny, tune policies via `/create-policy` (entity-sbom.md)
5. Add or adjust SBOM generation with `/create-sbom` if SBOM was missing
6. Automate with `/create-trigger`

CD pipelines: note in the summary if runtime inputs (service artifact, environment, infrastructure) will be required at run time — the user provides those via /run-pipeline or Harness UI Run.

Examples

Enforce after existing SBOM step

/enforce-sbom
Add SBOM policy enforcement to backend-api pipeline after Generate SBOM — keyless verify, policy set sbom_prod_rules

CD pipeline before deploy

/enforce-sbom
Enforce SBOM policies in deploy stage before K8s rolling deploy for myapp:v7

Defaults

/enforce-sbom
Use defaults — same image as SBOM orchestration step, Harness OIDC verify

Performance Notes

• Only existing pipelines — do not offer to create new pipelines (you may append a Deploy stage to an existing pipeline).
• Wizard UX is mandatory — one question per turn; see references/interactive-wizard-flow.md.
• CI-only + CD enforcement: allowed — Phase 3b adds Deploy stage + containerized group; do not redirect to CI unless the user chooses CI placement.
• Reuse SscaOrchestration source + image when present — avoids drift from generation step.
• List policy_set via MCP before Phase 9 — do not invent policy set identifiers.
• Enforcement after SBOM exists; orchestration and enforcement run sequentially.
• CD: CdSscaEnforcement only in containerized step groups.
• Do not execute pipelines in this skill — use /run-pipeline after configuration (same as /configure-repo-scan).
• Pair with /create-sbom (generate) and /create-policy (OPA rules).

Troubleshooting

No SBOM / Orchestration Step in Pipeline

• Add /create-sbom first, or ingest SBOM per Harness docs.
• Enforcement evaluates components from an existing SBOM for the artifact.

No Policy Sets Found

• harness_list(resource_type="policy_set") at project/org/account scope.
• Create SBOM policies (package sbom) and a policy set with onstep via /create-policy.

Policy Evaluation Failed (Deny)

• Review deny/allow lists in policy Rego (skills/create-policy/references/entity-sbom.md).
• Check execution Supply Chain → policy violations for component UUIDs.

Attestation Verification Failed

• Verification method must match SBOM Orchestration attestation (keyless vs key-based).
• Keyless non-harness: configure OIDC connector for keyless signing (SCS → Manage → Configuration).
• Key-based: public key file secret must match the key pair used when SBOM was attested.

Wrong Image / No SBOM for Artifact

• Use the same source.spec.image as SscaOrchestration.
• Symptom: policy passes but wrong artifact — image mismatch.

CD Step Validation Errors

• CdSscaEnforcement requires spec.infrastructure and containerized execution.
• Place inside stepGroup with stepGroupInfra — not top-level execution.steps on a Deployment stage.
• See skills/create-sbom/references/cd-containerized-step-group.md.

User Chose CD on CI-Only Pipeline

• Expected — run Phase 3b; do not re-ask Placement with only CI options unless the user changes direction.
• SBOM must still exist (from CI SscaOrchestration or ingestion); enforcement in CD uses the same artifact image/expression.

Pipeline Update Validation Errors

• DUPLICATE_IDENTIFIER — rename enforce_sbom.
• Invalid policy.policySets — use policy set identifiers, not display names.
• verifyAttestation shape — align with upstream attestation; see reference doc.

MCP Errors

• CONNECTOR_NOT_FOUND — verify connector in Project Settings.
• ACCESS_DENIED — PAT needs pipeline edit and policy read permissions.

Pipeline Run Failed

• Use /run-pipeline to execute and /debug-pipeline to diagnose failures
• Missing runtime inputs: provide branch/tag or deploy inputs via /run-pipeline or Harness UI Run
• Policy deny fails the step — expected when components violate rules; report violations clearly