fix(ci): gate release publishing on SBOM scan

scripts/release-workflow.test.tsmodified+9-1

Changes to scripts/release-workflow.test.ts

		⋯6 linesShow the 6 lines above this hunk@@ -7,7 +7,8 @@ type Job = {
7	7	needs?: string | string[]
8	8	if?: string
9	9	uses?: string
10		- steps?: { name?: string, run?: string, uses?: string }[]
	10	+ with?: { enforce_high?: boolean }
	11	+ steps?: { name?: string, run?: string, uses?: string, env?: Record<string, string> }[]
11	12	strategy?: { matrix: { platform: { name: string, os: string }[] } }
12	13	}
13	14	const release = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/release.yml'), 'utf8')) as { jobs: Record<string, Job> }
		⋯27 linesShow the 27 lines above this hunk@@ -41,6 +42,10 @@ test('npm publication follows artifact validation, and macOS downloads run on bo
41	42	])
42	43	expect(steps(release.jobs['verify-macos-downloads'])).toContain('scripts/verify-macos-release.ts')
43	44	expect(release.jobs['release-sbom'].uses).toBe('./.github/workflows/sbom.yml')
	45	+ expect(release.jobs['release-sbom'].with?.enforce_high).toBe(true)
	46	+ expect(needs(release.jobs.pantry)).toContain('release-sbom')
	47	+ expect(steps(release.jobs.pantry)).toContain('bun install --frozen-lockfile')
	48	+ expect(steps(release.jobs.npm)).toContain('bun install --frozen-lockfile')
44	49	expect(needs(release.jobs['attach-release-sbom'])).toContain('release-sbom')
45	50	expect(steps(release.jobs['attach-release-sbom'])).toContain('cmp "sbom/$document" "$VERIFY_DIR/$document"')
46	51	})
		⋯19 linesShow the 19 lines above this hunk@@ -66,6 +71,7 @@ test('a registry network failure remains a visible best-effort warning', () => {
66	71	test('SBOM generation validates required documents before uploading artifacts', () => {
67	72	const workflow = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/sbom.yml'), 'utf8')) as { jobs: Record<string, Job> }
68	73	const generate = workflow.jobs.generate.steps!
	74	+ expect(generate.find(step => step.name === 'Install dependencies')?.run).toBe('bun install --frozen-lockfile')
69	75	const validation = generate.findIndex(step => step.name === 'Validate SBOMs')
70	76	const upload = generate.findIndex(step => step.uses?.startsWith('actions/upload-artifact@'))
71	77	expect(validation).toBeGreaterThan(-1)
		⋯2 linesShow the 2 lines above this hunk@@ -74,4 +80,6 @@ test('SBOM generation validates required documents before uploading artifacts',
74	80	expect(command).toContain('bun scripts/verify-sbom.ts sbom "v$VERSION"')
75	81	expect(command).toContain("require('./package.json').version")
76	82	expect(command).not.toContain('||')
	83	+ const scan = workflow.jobs['vulnerability-scan'].steps!.find(step => step.name === 'Scan and validate vulnerability report')
	84	+ expect(scan?.env?.CRAFT_FAIL_HIGH).toBe('$')
77	85	})