Turn Trivy SBOM and SARIF output into versioned release evidence
Security tools already generate useful evidence. The problem at release time is often not another scan. It is proving which SBOM, test run, security report and code change belonged to one exact software version. CRA Release Evidence is a free, MIT-licensed GitHub Action for that narrow job. It reads files already present in the current workflow workspace and writes a version-specific EVIDENCE.md…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
