Skip to content

Supply Chain

Jump to bottom
Anna edited this page Jun 25, 2026 · 1 revision

Module: Supply Chain

Module flag: supplychain Enabled by default: yes

Overview

The Supply Chain module provides visibility into your container image pipeline: Artifact Registry repositories and images, Cloud Build triggers, and Service Directory namespaces. Use it to audit image provenance, build pipeline coverage, and service registration.

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules supplychain

Required GCP APIs

gcloud services enable artifactregistry.googleapis.com \
  cloudbuild.googleapis.com servicedirectory.googleapis.com

Required IAM Permissions

Role Tools that need it
roles/artifactregistry.reader gcp_artifactregistry_list_repos, gcp_artifactregistry_list_images
roles/cloudbuild.builds.viewer gcp_cloudbuild_list_triggers
roles/servicedirectory.viewer gcp_servicedirectory_list

Tools

gcp_artifactregistry_list_repos

Lists Artifact Registry repositories.

Parameters:

Name Required Description
project_id yes GCP project ID
location no Filter by region; - or omit for all regions

Returns: Repository name, format (DOCKER / MAVEN / NPM / PYTHON / GO / APT / YUM), location, size (bytes), create time, labels.

gcp_artifactregistry_list_images

Lists Docker images in an Artifact Registry repository.

Parameters:

Name Required Description
project_id yes GCP project ID
location yes Region
repository yes Repository name

Returns: Image URI, tags, build time, upload time, size (bytes), media type.

gcp_cloudbuild_list_triggers

Lists Cloud Build triggers.

Parameters:

Name Required Description
project_id yes GCP project ID

Returns: Trigger name, event type (PUSH / PULL_REQUEST / MANUAL / PUBSUB / WEBHOOK), enabled status, tags, config filename (cloudbuild.yaml path), included/excluded files, substitution variables, service account.

gcp_servicedirectory_list

Lists Service Directory namespaces and their registered services.

Parameters:

Name Required Description
project_id yes GCP project ID
location no Filter by region

Returns: Namespace name, location, services within each namespace (name, endpoints with host/port/metadata).

Prompt Examples

Image inventory

"List all Docker images in the gcr-mirror Artifact Registry repository in us-central1 for project my-project."

Build pipeline audit

"Which Cloud Build triggers are currently disabled in project my-project?"

Image tag audit

"Are any images in Artifact Registry in project my-project tagged latest — which repositories are they in?"

Provenance tracing

"Which Cloud Build triggers produce images pushed to the backend Artifact Registry repository?"

Related Modules

Module flag Why you'd combine it
cloudrun Match Cloud Run service container images to their Artifact Registry sources
gke_workloads Match GKE workload images to their Artifact Registry sources
archgraph Include supply chain in the full project architecture graph

Clone this wiki locally