scan: shared SBOM + osv-scanner + dtrack-panel triage report action

README.md

@@ -29,3 +29,15 @@ Both inputs are required so the consumer is explicit about source. Wire them to
 ## Versioning
 
 The repo follows lightweight tags: `v1`, `v1.0.0`, etc. Consumers pin to `@v1` for in-major updates, or `@<sha>` for full pinning.
+
+## `scan` — SBOM, osv-scanner and the triage report (v2)
+
+`uses: https://git.janhouse.lv/janhouse/sbom-tools-action/scan@v2` uploads the
+repo's source SBOM to Dependency-Track, runs osv-scanner over the repo, and
+reports to dtrack-panel which images the repo builds and its
+`osv-scanner.toml` `[[IgnoredVulns]]`. The panel's auto-triage then marks
+those NOT_AFFECTED in Dependency-Track — for the CI project and for the app's
+own dependency tree in the running images — and closes CI-project findings for
+dependencies that never reach the image (dev/build-time). Inputs and an example
+are in `scan/action.yml`. Authenticates with the same
+`DEPENDENCY_TRACK_API_KEY` the upload uses; no extra secret.