rave-wordpress

Reproduces WordPress builds and verifies that the official and unofficial packages haven't been tampered with. Maintained by johnbillion on GitHub, where it has earned 61 stars from the community.

It's actively developed around supply-chain-security, wordpress, and is a solid reference for anyone building with these tools.