also looking at this

fix(ci): gate release publishing on SBOM scan

#314

Merged glennmichael123 wants to merge codex/release-sbom-prerequisite into main

5 files +44 -9

glennmichael123 11 days ago

Summary

Make the reusable SBOM scan a prerequisite of Pantry publishing, so a failed scan stops native and npm release jobs.
Enforce the existing Critical rule on all scans and a High rule when the release workflow calls the scanner.
Use the committed Bun lockfile for SBOM generation and both publication paths.

134 script tests passed, including scan policy and release workflow checks.
Root typecheck, Pickier, and actionlint passed.
A local release-mode scan of the rehearsal SBOM exited with the expected policy failure. The detailed scan report remains local.

This PR does not create a release, tag, vulnerability exception, or advisory.

5 changed files on the files tab, with 0 review threads.