ci: generate SBOM and include it in the wheel

[milesdai]

This commit adds machinery to generate a CycloneDX SBOM file during the release flow. This file is automatically included in the built wheel by hatchling as specified in PEP 770. There is a placeholder SBOM file in the root directory to satisfy hatchling when building outside the release flow.

---

Summary by cubic

Generates a CycloneDX SBOM during the release flow and bundles it into the wheel per PEP 770. Adds CI steps and hatchling config, with a placeholder SBOM for non-release builds.

• New Features
  • New Generate SBOM job in .github/workflows/sdk-release.yml using uv/uvx and cyclonedx-bom==7.3.0 to create sbom.cdx.json.
  • SBOM is uploaded as an artifact and downloaded in the build job; build depends on SBOM generation.
  • pyproject.toml sets sbom-files = ["sbom.cdx.json"] and requires hatchling>=1.28.0 so the wheel includes the SBOM (PEP 770).
  • Adds a placeholder sbom.cdx.json to keep local and non-release builds working.

^{Written for commit 50fb7b1. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pyproject.toml">

<violation number="1" location="pyproject.toml:7">
P2: `sbom-files` requires a newer hatchling, but `build-system.requires` does not set a minimum version. Add a lower bound (>=1.28.0) to avoid build-time config failures in environments that resolve older hatchling versions.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}