Add SBOM pipeline

[mpreyskurantov]

No description provided.

[Copilot]

Pull request overview

Adds an SBOM generation/validation pipeline to the repo by introducing a dedicated tools/make-sbom pnpm project (using @devexpress/sbom-toolkit) and wiring SBOM build + validation into GitHub Actions (both a standalone SBOM workflow and the publish workflow).

Changes:

• Add tools/make-sbom pnpm project (lockfile, registry config, SBOM build script) for generating SBOMs for the packed CLI/schematics artifacts.
• Introduce a new .github/workflows/sbom.yml workflow to build, validate, and dry-run publish packages on the sbom-dev branch.
• Extend .github/workflows/publish.yml to also build/upload/validate SBOMs during publish runs, and ignore generated .tgz/dist outputs in .gitignore.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tools/make-sbom/pnpm-workspace.yaml	Adds pnpm workspace/tooling config for the SBOM tool project.
tools/make-sbom/pnpm-lock.yaml	Locks SBOM tool dependency graph for reproducible installs.
tools/make-sbom/package.json	Defines the SBOM tool project and SBOM generation script.
tools/make-sbom/.npmrc	Points @devexpress scope to GitHub Packages for SBOM toolkit installs.
.gitignore	Ignores generated package tarballs and SBOM output directory.
.github/workflows/sbom.yml	New workflow to build packages, generate SBOMs, validate them, and dry-run publish.
.github/workflows/publish.yml	Adds SBOM build/upload/validation to the publish workflow and updates some actions versions.

Files not reviewed (1)

• tools/make-sbom/pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

.github/workflows/publish.yml:35

• This workflow installs dependencies from both pnpm-lock.yaml and tools/make-sbom/pnpm-lock.yaml, but the pnpm cache key will only consider the default lockfile unless cache-dependency-path is set. Include the SBOM tool lockfile to avoid cache misses.

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.