TL;DR

This epic sets up a release CI pipeline for ABX Framework integrations (ABX). The pipeline scans each package's dependencies for vulnerabilities, signs the release artifacts and records every release, using DevProd's SilkBomb, Garasign and Papertrail.

Customers get integration packages that are checked for vulnerable dependencies and whose origin they can verify. For us, this is required to pass the Launch Readiness Assessment (LRA) before shipping new integrations like the Claude SDK one.

Shared constraints (apply to all child tickets)

• Pipeline: the SilkBomb, Garasign and Papertrail tickets each add a step to the ABX release pipeline, and depend on it existing.
• Repo structure isn't decided yet (one monorepo or one repo per integration). Every step must work for any layout, and adding a repo or package should mean registering it, not redesigning the pipeline.
• CI system: Evergreen or GitHub Actions, chosen by the implementing team.
• Provisioning: a single DEVPROD request to DevProd Release Infrastructure covers all three tools.
• Shared acceptance criterion: onboarding a new ABX repo or package to all three steps is documented.