For platform engineering teams

Bootstrap the control plane. Own the trust chain.

ClearCutt renders a GitHub-native repository that owns catalog inputs, workflows, evidence publication, policies, and app-team adoption paths. Start catalog-only from existing OCI images without Nix, then graduate to the fleet profile when ClearCutt should build the base-image fleet.

Configure

clearcutt.fleet.yaml is the single source of truth for registry owner, matrix targets, Nix cache trust, site settings, admission defaults, scan windows, and remediation caps.

Publish

GitHub Actions provides OIDC identity and artifact transport while the CLI configures Nix, builds, publishes, assembles, signs, attests, verifies, and finalizes the configured image fleet.

Onboard

App teams get matching dev images, runtime bases, certification policies, release workflows, and optional compatible-base rebase workflows.

Bootstrap Commands

# Render and plan a Nix-free catalog control plane
clearcutt platform bootstrap github \
  --profile catalog-only \
  --owner acme \
  --repo image-platform \
  --registry-base ghcr.io/acme/image-platform \
  --pages \
  --environment production \
  --dir ./image-platform \
  --dry-run \
  --force

# Review the GitHub plan, then explicitly apply when ready
clearcutt platform plan github \
  --dir ./image-platform \
  --owner acme \
  --repo image-platform \
  --profile catalog-only \
  --pages \
  --environment production \
  --output ./image-platform/.clearcutt/clearcutt.plan.json

clearcutt platform apply github \
  --plan ./image-platform/.clearcutt/clearcutt.plan.json \
  --confirm

# Fleet profile keeps the existing image-factory scaffold path
clearcutt platform render ./golden-images \
  --profile fleet \
  --owner acme \
  --repo golden-images \
  --registry-host ghcr.io \
  --image-prefix golden-images \
  --force

# Check that the fleet scaffold is wired together
clearcutt platform status --output ./golden-images

# Configure and warm the fleet Nix client from clearcutt.fleet.yaml
clearcutt platform setup-nix --core-dir core --write-user-config

# Inspect the matrix GitHub Actions will run
clearcutt --format json matrix export --source fleet --github-actions --matrix release

# Release workflow dogfoods these config-driven operators
clearcutt platform setup-nix --core-dir core --skip-warm
clearcutt fleet certify-target --system x86_64-linux --language java25 --tier slim
clearcutt fleet publish-target --system x86_64-linux --language java25 --tier slim --version-tag v1.2.3
clearcutt fleet assemble-target --language java25 --tier slim --version-tag v1.2.3

# Generate an app-team starter
clearcutt app template java --output examples/payments-api

# Build catalog data from releases, registry evidence, SBOMs, and scans
clearcutt catalog build --limit 10 --scan-depth 4

Catalog Site Lifecycle

The generated catalog site is a publishable asset for downstream users. Keep content and homepage role paths in clearcutt.site.yaml, then build the static site from generated catalog JSON instead of hand-editing the template.

# Generate and validate catalog JSON
clearcutt catalog generate --config clearcutt.fleet.yaml --output ./dist/catalog
clearcutt --catalog ./dist/catalog catalog validate

# Scaffold or refresh the generated site project
clearcutt catalog site scaffold --catalog ./dist/catalog --output ./catalog-site

# Build and preview the generated static site
clearcutt catalog site build --catalog ./dist/catalog --output ./dist/site --install
clearcutt catalog site preview --catalog ./dist/catalog --install --host 127.0.0.1 --port 4321

Evidence Boundaries

The catalog reports signatures, SBOMs, SLSA Build L3 provenance, test results, and vulnerability scans independently. A missing evidence channel stays visible instead of being inferred from another check.

Remediation is approved automation: scheduled scans create ranked scan, plan, and report output; opt-in drafting can open gated PRs for review. The workflow does not silently merge, deploy, or rewrite production images.