Release intelligence without the weekly chase.

The situation

Tracking vendor releases and associated vulnerabilities can become a recurring manual task. For a retail bank, the work was to automate that release intelligence and connect it to the place where follow-up work was managed. The scope also included turning JFrog Xray scan output into residual-risk entries.

The decision

I built an autonomous release tracker on GitHub Actions. The useful boundary was the recurring collection and mapping work: identify releases and vendor CVEs, then put the relevant items into Jira. Making those outputs actionable was as important as collecting the source information.

Making it work

The workflow linked release tracking to Jira and connected Xray scan results to residual-risk entries. It was replicated for three vendors. GitHub Actions provided the execution environment, keeping the automation within an existing engineering workflow rather than requiring a separately operated service.

The result

For the reported operating scope, the tracker mapped 100% of vendor CVEs to Jira, used approximately eight seconds of runtime per day, and required zero minutes of weekly manual tracking effort. Its reported incremental infrastructure cost was $0. Those figures describe this workflow and its use; they do not imply that maintenance or human review of risk is unnecessary.

What I took forward

Small automation is worth owning when its input, output and responsibility are clear. The tracker removed the repeated collection step. The resulting work items and residual-risk entries kept the security decision available to the people responsible for it.