IgniteUI / igniteui-cli / 41995986450

95%

push

github

ci(release): add SBOM evidence and attestations for published packages (#1878)

* ci(release): add SBOM evidence for published packages, disable npm publish

Pack every publishable package once and describe the exact tarballs with
validated CycloneDX 1.6 SBOMs, build provenance and per-package SBOM
attestations, then attach the evidence to the GitHub release. Licenses a
package does not declare are looked up on ClearlyDefined; gaps produce a
warning instead of failing the release.

npm publish (and the MCP Registry job that depends on it) is disabled
until the flow is validated with a dummy GitHub release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(mcp): declare the MIT license in @igniteui/mcp-server's package.json

The README already states MIT; without the field the package's SBOM
component carried no license and every release raised a license-gap warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(release): drop registry-url from the build job

setup-node v7 no longer exports a dummy NODE_AUTH_TOKEN, and yarn 1 fails on
the ${NODE_AUTH_TOKEN} reference in the .npmrc that registry-url writes. The
build job never publishes, so it does not need the registry configuration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(release): set versions to 0.0.0 for the dummy release

TEST ONLY - revert before merging. The release workflow validates that the
MCP server's package.json and server.json match the release tag, so the
dummy 0.0.0 release needs igniteui-cli, @igniteui/cli-core and
@igniteui/mcp-server at 0.0.0 and the internal ~ranges pointing at it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Revert "chore(release): set versions to 0.0.0 for the dummy release"

This reverts commit 48562a5d6.
The dummy 0.0.0 release validated the workflow; the packages return to 15.8.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(release): re-e... (continued)

1717 of 1994 branches covered (86.11%)

Branch coverage included in aggregate %.

9400 of 9663 relevant lines covered (97.28%)

181.75 hits per line