CRAVEX-integration: Integration with SCA Tools

[pombredanne]

It would be great to have integration with other SCA tools, especially support for existing tools already deployed by a software team. This is an important use case where DejaCode/CRAVEX is used as the system of records for compliance workflows and data.

• CRAVEX-integration: Integration with SCA Tools - generic framework #1726
• CRAVEX-integration: Integration with SCA Tools: Anchore #1728
• CRAVEX-integration: Integration with SCA Tools: Trivy #1729
• CRAVEX-integration: Integration with SCA Tools: one select OWASP-CycloneDX scanner #1734
• CRAVEX-integration: Integration with SCA Tools: OWASP-depscan #1733
• CRAVEX-integration: Integration with SCA Tools: sbom-tool #1732
• CRAVEX-integration: Integration with SCA Tools: OSV scanner #1730
• CRAVEX-integration: Integration with SCA Tools: ORT #1727
• CRAVEX-integration: Integration with SCA Tools: cyclonedx-gomod #1731

[tdruez]

As of Sept 1, 2025

Tool	CycloneDX	SPDX	Docker image support	GH Action
Anchore	1.6	–	✅	scan-action
CycloneDX cdxgen	1.6	–	✅	–
cyclonedx-gomod	1.6	–	❌	gh-gomod-generate-sbom
ORT	1.6	2.2, 2.3	❌	ort-ci-github-action
OSV-Scanner	1.5	2.3	✅	–
OWASP dep-scan	1.6	–	✅	–
SBOM tool	–	2.2, 3.0	✅	–
Trivy	1.6	2.3	✅	trivy-action

[pombredanne]

@tdruez

• I updated CRAVEX-integration: Integration with SCA Tools: cyclonedx-gomod #1731 to use instead the gomod tools from CycloneDX

[tdruez]

All SCA integrations listed above are now completed.