Highlights

• policy-aware reporting and enforcement-oriented CLI behavior
• GitHub-compatible SARIF export with code scanning validation on main
• conservative parser tightening for deterministic local mode
• sbom-diff-and-risk package version bumped to 0.2.0

Verification

• local python -m pytest passed before release
• GitHub code scanning analysis on main now reports tool version 0.2.0