Tutorials: Provenance
Learn Provenance step by step.
- Your first supply-chain review in 5 minutesOpen the Node.js release template, run all checks, read the release gate and the dashboard, and find the first thing to fix. No account, nothing to install.Beginner 5 min
- Triage findings — status, owners, due dates and remindersWork through the findings register like a security team: filter and sort, read a finding, set status, owner and due date, mark accepted risks and export calendar reminders.Beginner 8 min
- Release gate and policy — decide whether a build can shipConfigure the policy rules (severity threshold, KEV, licences, root containers, end-of-life bases, provenance, Scorecard, web grade, OAuth risk, overdue) and read the pass, warn or fail verdict.Intermediate 8 min
- Compare over time and side by sideSave baselines and see what is new, resolved or re-rated after the next run, then compare two images or two package versions as an A/B scenario.Intermediate 10 min
- Import your own SBOMs, lockfiles and asset listsBring in CycloneDX and SPDX SBOMs, package-lock.json or requirements.txt, and long lists of images, packages, CVEs and domains in one paste — then run them as a batch.Beginner 7 min
- Reports, sharing and automation with the API and MCPPrint the consolidated report, export Markdown, CSV and JSON, share a project link, save to Google Drive, and let scripts or AI agents build projects and call the same twelve tools.Advanced 10 min