Generate and publish a CycloneDX SBOM for every release build in .github/workflows/ci.yml

[Jagadeeshftw]

Description

.github/dependabot.yml keeps pnpm-lock.yaml current, but there is no generated software bill of materials artifact for a given release commit, so answering "exactly which package versions shipped in production build X" requires reconstructing it from the lockfile after the fact. Add a CI step that generates a CycloneDX SBOM from pnpm-lock.yaml on release builds and uploads it as a build artifact.

Requirements and context

• Add an SBOM-generation step (e.g. @cyclonedx/cyclonedx-npm) to .github/workflows/ci.yml, gated to release/tag builds so every PR does not pay the cost
• Upload the resulting SBOM as a GitHub Actions artifact attached to the workflow run
• Add a small verification script asserting the generated SBOM is well-formed JSON and includes the expected root package
• Must be secure, tested, and documented
• Should be efficient and easy to review

Suggested execution

Fork the repo and create a branch

git checkout -b feature/sbom-generation

Implement changes

• Update/Write: .github/workflows/ci.yml
• Update/Write: scripts/verify-sbom.ts
• Add/Update tests: scripts/verify-sbom.ts
• Add documentation: README.md
• Include clear code comments and TS types
• Validate security assumptions

Test and commit

• Run tests: pnpm test
• Cover edge cases
• Include test output and security notes

Example commit message

feat: generate CycloneDX SBOM on release builds

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours

[malaysiaonelove]

Hi maintain,I will love to work on this issue,I have an experience and I have already reviewed the issue please assigned me to it and I will give a good result i will do best

[grantfox-oss]

🦊 GrantFox — @malaysiaonelove has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #690)
2. Your PR will be reviewed by the Stellopay maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@malaysiaonelove's PR #723 was approved and merged by @Jagadeeshftw.

🏆 @malaysiaonelove: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (471 total points). Track your full progress on GrantFox.

👏 Great work, @malaysiaonelove! Keep contributing to Stellopay.