Your build starts here
Replace bracketed details with your own goal, context, and checks. Keep the first build small enough to inspect.
Prepare [release artifact] from the intended source commit using the existing build workflow. Record direct and transitive dependencies, the component inventory when supported, and an immutable artifact digest. Review packaging inputs for credentials and unnecessary files. Check relevant dependency advisories in context and protect build and runtime credentials according to their actual roles. Verify that the checked artifact is the deployed artifact, then smoke-test the main journey. Report release provenance, checks, unresolved issues, and any required credential rotation without revealing secret values.Make this prompt yours
Replace bracketed fields with your goal, current behavior, and relevant evidence. Keep requirements that affect the task. Check the result against the acceptance criteria you supplied.
The docs behind it
These references explain the underlying concepts and APIs. The prompt templates and project plans are original examples to adapt to your own setup.
- SLSA — Build provenance attestation
- SPDX — Software bill of materials specification introduction
- OWASP — Secrets management and rotation
Documentation links checked .
Editorial review · October 28, 2026
Limited: Original instructional template; not executed. Traceable-release prompt requests actual artifact and smoke-check evidence; no build, deployment, advisory remediation, or credential rotation was performed.