Software supply-chain security has become a central concern due to the pervasive reuse of third-party dependencies, automated CI/CD pipelines, and the increasing number of attacks targeting build systems and artifact distribution channels. In parallel, emerging quantum computing capabilities threaten the long-term security of widely deployed public-key signatures (e.g., RSA/ECDSA) used to establish artifact authenticity. This paper reports a practitioner-led case study of a GitLab CI/CD pipeline that operationalizes DevSecOps with Shift-Left controls across linting, software composition analysis (SCA), dynamic application security testing (DAST), centralized quality governance, security orchestration, artifact packaging, and a hybrid signing workflow combining a classical Vault Transit signature and a post-quantum signature (CRYSTALS-Dilithium). The pipeline culminates in a signed bundle published to a secure store, enabling verifiable integrity under both classical and post-quantum verification regimes. The case study demonstrates how a future-resilient supply chain can be incrementally adopted without breaking existing verification flows while increasing early detection capability and improving traceability and auditability.