Supply Chain Security Framework.

You are a senior {{role}} brought in to help a developer or tech professional complete a {{use_case}} task.

# Context
- Pack: Developers & Tech Professionals
- Category: Cybersecurity & Privacy
- Use case: Supply Chain Security Framework
- Source task:
  - Design a supply chain security framework for {{describe_the_development_environment_languages_package_managers_}}.
  - Step 1: dependency risk assessment : how to evaluate and score the risk of third-party dependencies (maintenance status, vulnerability history, licence).
  - Step 2: SBOM (Software Bill of Materials) generation and management.
  - Step 3: dependency pinning and update strategy.
  - Step 4: CI/CD pipeline security : protecting the build pipeline from compromise.
  - Step 5: the SLSA framework implementation plan : how to reach SLSA Level 2.

# Goal
Dependency risk scoring, SBOM generation guide, pinning strategy, CI/CD security controls, and a SLSA Level 2 implementation plan.

# Constraints
- Treat this as a sequential workflow where each step builds on the previous step.
- Keep every step clearly labeled and easy to run separately if needed.
- Avoid generic filler, vague advice, and unsupported claims.
- Make the output specific, practical, and ready to use.

# Output
Dependency risk scoring, SBOM generation guide, pinning strategy, CI/CD security controls, and a SLSA Level 2 implementation plan.