Trivy SBOM 및 SARIF 출력을 버전이 지정된 릴리스 증거로 전환

Security tools already generate useful evidence. The problem at release time is often not another scan. It is proving which SBOM, test run, security report and code change belonged to one exact software version.

CRA Release Evidence is a free, MIT-licensed GitHub Action for that narrow job. It reads files already present in the current workflow workspace and writes a version-specific EVIDENCE.md, evidence.json, changes.json, SHA-256 manifest and SBOM directory.

It is not a CRA scanner, legal advice, a conformity assessment or a compliance verdict. Product scope, cybersecurity risk decisions, release approval, conformity work, CE marking and regulatory notifications remain human responsibilities.

A concrete Trivy workflow

The new copy-ready example runs Trivy twice on the released revision:

1. CycloneDX output becomes the imported release SBOM.
2. SARIF output becomes indexed security-scan evidence.
3. CRA Release Evidence binds both files to the release tag, checked-out commit and Git change summary.

The workflow is here:

https://github.com/mastermuetze/cra-release-evidence/blob/main/examples/trivy-release-evidence.yml

All third-party Actions are pinned to reviewed 40-character commit SHAs. The job grants only contents: read.

Why two output formats?

CycloneDX answers the inventory question. SARIF carries findings. The evidence collector does not reinterpret findings or automatically accept risk. Instead, it records whether the configured category exists, the producing revision declared by the workflow, a neutral summary and a SHA-256 digest.

Raw SARIF is not copied unless include-raw-reports: true is set. The imported SBOM is always part of the package and may expose product structure, so the artifact destination and retention still need review.

Add tests without changing the model

If the same job already creates JUnit XML, add the path and require test-results:

with:
  evidence-paths: |
    reports/trivy.sarif
    reports/**/junit*.xml
  required-evidence: sbom,test-results,security-scan,change-summary

Enter fullscreen mode Exit fullscreen mode

Reports from earlier jobs must first be downloaded into the current workspace. The collector intentionally does not fetch scanner portals, earlier artifacts or GitHub Code Scanning through APIs.

Try it

The complete setup and interpretation guide is here:

https://github.com/mastermuetze/cra-release-evidence/blob/main/docs/TRIVY-RELEASE-EVIDENCE.md

The Action is also available in the GitHub Marketplace:

https://github.com/marketplace/actions/cra-release-evidence

I am validating the free collector before considering a paid platform. A real activation means an external repository produced both Markdown and parseable JSON for an actual product release. Stars and copied workflow files do not count.