When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Not yet released. There’s no published action or tagged release yet. Planned: an action that downloads a pinned, checksum-verified release binary, then runs scan push followed by status. It will fail the job when anything is overdue. Planned usage, once published:

name: craclock
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: craclock/craclock/action@v1
        with:
          api-key: ${{ secrets.CRACLOCK_API_KEY }}