Open Build and Agent Assurance Framework (OBAAF)
OBAAF is a free, open framework for keeping malicious code out of the software updates people install. It secures the build pipelines that produce those updates, and the AI agents now connected to them. It works for any team that ships software updates. Its checker reads GitHub Actions workflows and, as an advisory auditor, Jenkinsfiles; the specification and self-assessment name no CI product. The first version is shaped by the needs of small teams without dedicated security staff, independent game studios among them, whose updates reach phones, PCs and consoles.
Status: version 0.3, in active adoption. OBAAF is on PyPI (pip install obaaf) and in use with pilot teams. The first external pilot ran the checker on a production repository; its feedback is tracked in issue #19 and shapes the 0.2 roadmap. The checker was also exercised in a limited GitHub Actions demonstration. Broader platform validation continues, and formats may still change before 1.0. The code is licensed under Apache-2.0 and the specifications and documentation under CC BY 4.0. This is not a research-paper submission. The specifications and tools are built only from public standards and public documentation. See LICENSING.md.
Design decisions, including those still proposed, are tracked in DECISIONS.md.
What is here
| Component | What it does | Where |
|---|
| Build-integrity profile | 28 requirements in nine control families that tailor NIST's SSDF and SLSA to software build pipelines, with game studios as the worked example, each with a test and its mappings | spec/profile.md |
| Agent controls | Taint-bounded authority, eight requirements (R1–R8), a three-lane architecture and a signed record of each agent run | spec/agent-controls.md |
| Self-assessment | 34 yes-or-no questions in four tiers that give a tier and a ranked list of fixes, on paper, in an offline form, or from the command line | spec/self-assessment.md, offline form |
| Team resource site | A public resource introducing the framework, questionnaire, workflow demonstration, and adoption steps | Build and preview instructions |
| Reference pipeline templates | GitHub Actions workflows for four lanes: untrusted contributions, agents, approved changes and releases; Jenkins pipelines for the release lane and an audit job | templates/github-actions, templates/jenkins |
| Verification tools | A pipeline checker that flags risky settings in GitHub Actions workflows and, as an advisory auditor, in Jenkinsfiles (Jenkins); a release verifier that blocks uploads without valid provenance, approvals and agent records; and checks on an agent's signed record and proposal before anything is applied | spec/checker-rules.md, obaaf verify release, obaaf verify agent-run, obaaf proposal check |
The profile, the agent controls and the self-assessment come from the author's two companion papers, both available on Zenodo with DOIs:
Their machine-readable form in src/obaaf/data/ is the single source of truth: the documents in spec/ and the offline form are generated from it.
How it fits together
flowchart LR
subgraph untrusted["Untrusted lane"]
PR["Pull requests,<br/>including partners' forks"] --> CI["Build and test<br/>no secrets, read-only"]
end
subgraph agent["Agent lane (level of its inputs)"]
EV["Issue or comment"] --> SN["Snapshot<br/>digests and labels"] --> AG["Agent<br/>read-only, no secrets"] --> PB["Proposal bundle"]
PB --> AT["Attestation step<br/>signs agent-run record"]
end
subgraph effect["Effect lane (Maintainer)"]
AP["Approval by someone<br/>other than the requester"] --> EF["Checks, then applies<br/>as a pull request"]
end
subgraph release["Release lane (Release)"]
BU["Isolated build from a tag<br/>Tier A or B, no shared cache"] --> PV["Signed provenance<br/>and build record"] --> VE["Verify from the default branch,<br/>then a person approves"] --> UP["Upload; a person<br/>sets it live"]
end
AT --> AP
EF --> PRV["Reviewed merge"] --> BU
Quick start
OBAAF needs Python 3.10 or later.
pip install "obaaf[keys]" # omit [keys] if you only need assess and check
obaaf --help
Teams. Start with the self-assessment. Open the offline form in a browser, or:
obaaf assess init --output answers.yaml # fill in yes, no or na
obaaf assess score answers.yaml # your tier and what to fix first
Your answers never leave your machine. Then follow the adoption guide.
Build engineers. Check your GitHub Actions workflows and Jenkinsfiles, then install the templates (GitHub Actions; for Jenkins, see Jenkins):
obaaf check path/to/your/repository
obaaf templates install --dest path/to/your/repository --obaaf-repo OWNER/obaaf --obaaf-sha <commit>
This is the beginning of the README. Read the rest at the original. Read the full README ↗
