CI/CD and secure supply chain

https://www.sigstore.dev/ ( & cosig https://github.com/sigstore/cosign )

https://in-toto.io/

(cf. red hat trusted software supply chain which actually embeds those open source tools)

+ backstage.io for "platform engineering"