cra readiness skill — Evaluates GitHub repo compliance…

Pitch

Description

Comments

About this project

This agent skill assesses a software repository's readiness for the EU Cyber Resilience Act, providing startup founders with a clear, plain-English letter grade. By leveraging a 3-tier scan control architecture, it identifies compliance gaps and offers remediation templates, enabling developers to ensure their products meet regulatory standards for the European market.

The EU Cyber Resilience Act (CRA) Readiness Skill is a comprehensive tool designed to evaluate software repositories against the 40-item CRA Manufacturer Compliance Matrix in accordance with Regulation EU 2024/2847. This skill implements a robust 3-tier scan control architecture to provide startup founders a clear assessment of how ready their GitHub repository is for compliance with the Cyber Resilience Act. It generates a plain-English letter grade (A, B, C, D) reflecting the repository's compliance status, accompanied by actionable remediation templates for improvement.

Key Features

Automated Evaluation: The tool analyzes repositories and produces a grade based on compliance readiness, systematically assessing both technical implementations and governance policies.
Clear Communication: Founders receive immediate feedback on their repository’s standing, addressing critical questions regarding their ability to launch in the EU market without regulatory penalties.
Remediation Templates: The skill includes ready-to-use documentation templates that facilitate compliance upgrades, allowing users to transition quickly from lower grades to higher compliance status.

The Grading System

The grading system allows founders to understand their status easily:

Grade	Status	Meaning for Founders	Fast Remediation
🟢 A	Ready for EU Launch	Clear readiness with robust policies in place.	Maintain documentation for compliance.
🟡 B	Need Automation Work	Compliance exists but lacks automated checks.	Enhance with CI/CD automation.
🟠 C	Need Automation & Policy Work	Missing essential checks and documentation.	Integrate necessary templates and enable CI workflows.
🔴 D	Incomplete Assessment	Assessment could not be performed due to access issues.	Ensure repository permissions are correctly set.

Utilizing the Skill

Users can easily integrate this skill into their workflow using tools like Claude, or through a standalone command-line interface. The provided examples guide users on how to set up automated compliance checks directly within their GitHub workflows or execute offline evaluations.

Example Usage

For automated audits, a reusable GitHub Action can be added:

name: CRA Readiness Audit
on: [push, pull_request]

jobs:
  cra-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: aaronbronow/cra-readiness-skill@v1
        with:
          format: 'markdown'
          fail-on-grade: 'D'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Alternatively, it can run via command line:

python3 scripts/collector.py /path/to/repo

About the Compliance Process

The 3-tier architecture divides the evaluation process into:

Deterministic Tool Engine: Thoroughly assesses files and configurations, providing immediate and actionable statuses.
Agent Semantic Explanation: Offers in-depth analyses of policy documents ensuring adherence to CRA requirements.
Guided Founder Questionnaire: Engages users with targeted prompts to clarify organizational compliance.

This skill provides a structured pathway for startups to achieve compliance with the EU Cyber Resilience Act efficiently and effectively.