chore(release): swap SBOM tool to cdxgen — Corepack-proof (#69)

PR #68's `npm install --package-lock-only` SBOM fix did not survive
contact with the runner. The v1.2.0 publish attempt at run 25407540759
hit the same "no evidence: no package lock file" error from
@cyclonedx/cyclonedx-npm.

Root cause: Corepack interception. When the workspace's
`package.json#packageManager` is `pnpm@9.12.0`, Corepack (bundled with
Node 20) intercepts direct `npm install` calls and either rejects
them or rewrites them to pnpm — neither of which generates the
`package-lock.json` that cyclonedx-npm requires as evidence.

Fix: switch to `@cyclonedx/cdxgen@11`. cdxgen is the multi-package-
manager CycloneDX generator and reads `pnpm-lock.yaml` natively from
the workspace root. No transient lockfile round-trip; no Corepack
interaction.

Workflow change is local to the SBOM step:
- Replace `npx @cyclonedx/cyclonedx-npm@2.1.0 ...` with
  `npx @cyclonedx/cdxgen@11 --type js --no-recurse --spec-version 1.5 ...`
- Drop the `npm install --package-lock-only` and `rm package-lock.json`
  scaffolding (no longer needed).
- `FETCH_LICENSE: "true"` env so the SBOM includes upstream license
  metadata where available.

Updated `packages/k8s-baseline/tests/release-readiness.test.ts`
invariant to assert `@cyclonedx/cdxgen` instead of
`@cyclonedx/cyclonedx-npm`.

After this PR merges: delete the failed v1.2.0 tag once more, retag at
the new HEAD, push.

  git tag -d v1.2.0
  git push origin --delete v1.2.0
  git tag -a v1.2.0 -m "v1.2.0 — atomic four-package release: K8s security + Operations + pre-public-launch"
  git push origin v1.2.0

Verified locally: 487 tests pass; format/lint/license-boundary/pin-guard
all clean.

Signed-off-by: Sherif Mansour <13433538+kerberosmansour@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kerberosmansour

.github/workflows/release.yml

@@ -88,26 +88,31 @@ jobs:
           done
           ls -la .release-artifacts/
 
-      - name: Generate SBOMs (CycloneDX)
-        # @cyclonedx/cyclonedx-npm requires npm-style evidence in each
-        # package directory: a `package-lock.json`, an `npm-shrinkwrap.json`,
-        # or a local `node_modules/`. Hulumi is a pnpm workspace — there is
-        # no `package-lock.json` (deleted in runbook hulumi-pre-public-launch
-        # M1) and pnpm hoists `node_modules/` to the workspace root rather
-        # than per-package. We generate a transient `package-lock.json` per
-        # package via `npm install --package-lock-only` (resolution only —
-        # no install happens; `--ignore-scripts` blocks any postinstall
-        # hooks), run the SBOM, then delete the transient lockfile so the
-        # repo's pnpm-only invariant is preserved across the workflow run.
+      - name: Generate SBOMs (CycloneDX, via cdxgen)
+        # cdxgen is the multi-package-manager CycloneDX generator. It reads
+        # `pnpm-lock.yaml` natively, so no transient `package-lock.json`
+        # round-trip is needed. The previous fix (`npm install
+        # --package-lock-only`) was intercepted by Corepack — when the
+        # workspace's `package.json#packageManager` is `pnpm@9.12.0`,
+        # Corepack rejects or rewrites direct npm calls, so the lockfile
+        # never got created and `@cyclonedx/cyclonedx-npm` errored with
+        # "No evidence: no package lock file nor `node_modules` dir".
+        # Switching to cdxgen sidesteps the Corepack interaction
+        # entirely.
+        env:
+          # cdxgen reads `pnpm-lock.yaml` from the workspace root and
+          # the package.json from the per-package directory. Run from
+          # the repo root so pnpm-lock.yaml is discoverable.
+          FETCH_LICENSE: "true"
         run: |
           set -euo pipefail
           for pkg in baseline policies drift k8s-baseline; do
-            (cd "packages/$pkg" && npm install --package-lock-only --ignore-scripts --silent)
-            npx --yes @cyclonedx/cyclonedx-npm@2.1.0 \
-              --output-format json \
-              --output-file ".release-artifacts/sbom-${pkg}.cdx.json" \
+            npx --yes @cyclonedx/cdxgen@11 \
+              --type js \
+              --no-recurse \
+              --spec-version 1.5 \
+              --output ".release-artifacts/sbom-${pkg}.cdx.json" \
               "packages/$pkg"
-            rm -f "packages/$pkg/package-lock.json"
           done
 
       - name: Attest provenance for tarballs

packages/k8s-baseline/tests/release-readiness.test.ts

@@ -54,15 +54,14 @@ describe("Feature: K8s package release readiness (Runbook M1)", () => {
 
     it("release workflow generates a CycloneDX SBOM for k8s-baseline", () => {
       const yml = readRepoFile(".github/workflows/release.yml");
-      // SBOM output filename per package (post-M5 release.yml writes
-      // ".release-artifacts/sbom-${pkg}.cdx.json" inside a loop, so the
-      // file path appears via the loop's variable expansion in the run
-      // block; the literal `sbom-k8s-baseline.cdx.json` only appears if
-      // the loop variable is statically referenced — which it isn't
-      // post-pnpm-SBOM-fix. Instead, assert the loop iterates over the
-      // four-package set + invokes cyclonedx-npm.
+      // SBOM output filename per package: post-cdxgen-swap, release.yml
+      // writes `.release-artifacts/sbom-${pkg}.cdx.json` inside a loop
+      // that iterates the four-package set. cdxgen is the
+      // multi-package-manager CycloneDX generator that reads
+      // pnpm-lock.yaml natively (sidesteps the Corepack interception
+      // that broke the previous @cyclonedx/cyclonedx-npm approach).
       expect(yml).toMatch(/for pkg in baseline policies drift k8s-baseline/);
-      expect(yml).toMatch(/@cyclonedx\/cyclonedx-npm/);
+      expect(yml).toMatch(/@cyclonedx\/cdxgen/);
       // The output-file template uses the loop variable.
       expect(yml).toMatch(/sbom-\$\{pkg\}\.cdx\.json/);
     });