Gate SBOM findings on whether they ship

.github/workflows/sbom.ymlmodified+6-0

Changes to .github/workflows/sbom.yml

		⋯128 linesShow the 128 lines above this hunk@@ -129,6 +129,12 @@ jobs:
129	129	env:
130	130	CRAFT_FAIL_HIGH: ${{ inputs.enforce_high || false }}
131	131
	132	+ # Always on, unlike enforce_high. Fails when a High or Critical finding is
	133	+ # not confined to paths that publish nothing, and prints the tooling
	134	+ # inventory otherwise so the count stays visible rather than silent.
	135	+ - name: Require High findings to be tooling-only
	136	+ run: bun scripts/sbom-scope.ts scan-results/vulnerabilities.json
	137	+
132	138	- name: Upload scan results
133	139	if: ${{ always() }}
134	140	uses: actions/upload-artifact@v4