A detailed walkthrough of a three-layer software supply chain security architecture built for a polyglot microservices environment using Java, Python, Node, and Go. The system centers on a centralized Parent File (global dependency manifest) that pins approved versions across all services, eliminating version drift and shadow dependencies. Layer I uses GitLab with a centralized manifest and a daily Trivy cron job for continuous audit. Layer II enforces security gates in Jenkins CI/CD pipelines using CrowdStrike Falcon's scanner and a Pipeline Breaker that blocks vulnerable images from reaching ECR. Layer III continuously re-scans images at rest in AWS ECR every 2–4 hours. The post also covers a structured Break Glass procedure for emergencies, SBOM generation via Falcon, a developer-friendly dependency request workflow, and hard-won lessons including transitive dependency pinning and managing false positives.
