Insights / release evidence
A release evidence checklist for audits.
Evidence should explain who changed what, which controls ran, who approved the release and what reached production.
Retain five linked records
- Change: pull request, reviewer and linked issue.
- Build: immutable commit, build result and artifact digest.
- Security: scan result, dependency inventory and exceptions.
- Approval: decision, approver and policy context.
- Deploy: environment, timestamp and rollback reference.
A screenshot without an immutable reference is weak evidence. Use identifiers that let an auditor follow one release across every record.
Need release evidence that holds together?
Start with a fixed-scope supply-chain review.