Comment by jzelinskie

I think GitHub will do this for you now: https://docs.github.com/en/code-security/supply-chain-securi...