fix(ci): gate release publishing on SBOM scan

scripts/scan-sbom.test.tsmodified+10-1

Changes to scripts/scan-sbom.test.ts

		⋯1 lineShow the 1 line above this hunk@@ -2,7 +2,7 @@ import { afterEach, expect, test } from 'bun:test'
2	2	import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
3	3	import { tmpdir } from 'node:os'
4	4	import { join } from 'node:path'
5		-import { scanSbom, summarizeVulnerabilities } from './scan-sbom'
	5	+import { enforceScanPolicy, scanSbom, summarizeVulnerabilities } from './scan-sbom'
6	6
7	7	const roots: string[] = []
8	8	afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }) })
		⋯9 linesShow the 9 lines above this hunk@@ -18,6 +18,15 @@ test('counts all supported severities without mistaking absent results for zero'
18	18	expect(() => summarizeVulnerabilities(invalid)).toThrow()
19	19	})
20	20
	21	+test('High findings block release scans and Critical findings block every scan', () => {
	22	+ const high = summarizeVulnerabilities(report([match('High')])).counts
	23	+ expect(() => enforceScanPolicy(high, false)).not.toThrow()
	24	+ expect(() => enforceScanPolicy(high, true)).toThrow('High vulnerabilities block this release')
	25	+ const critical = summarizeVulnerabilities(report([match('Critical')])).counts
	26	+ expect(() => enforceScanPolicy(critical, false)).toThrow('Critical vulnerabilities')
	27	+ expect(() => enforceScanPolicy(critical, true)).toThrow('Critical vulnerabilities')
	28	+})
	29	+
21	30	function fixture(source: string) {
22	31	const root = mkdtempSync(join(tmpdir(), 'craft-grype-test-'))
23	32	roots.push(root)