chore: add SBOM generation and vulnerability audit to release pipeline

.release-it.json

@@ -23,8 +23,9 @@
   },
   "npm": false,
   "hooks": {
+    "before:init": "pnpm audit --audit-level=high --prod",
     "after:bump": "tsx tools/sync-versions.ts ${version} && pnpm build:notice && git add NOTICE.md",
-    "before:release": "pnpm build && pnpm --filter=docs build && pnpm --filter=@databricks/appkit dist && pnpm --filter=@databricks/appkit-ui dist",
+    "before:release": "pnpm build && pnpm --filter=docs build && pnpm --filter=@databricks/appkit dist && pnpm --filter=@databricks/appkit-ui dist && pnpm release:sbom",
     "after:release": "npm publish packages/appkit/tmp --access public --provenance && npm publish packages/appkit-ui/tmp --access public --provenance"
   },
   "plugins": {

package.json

@@ -34,6 +34,7 @@
     "pack:sdk": "pnpm build && pnpm --filter=docs build && pnpm -r tarball",
     "prepare": "husky",
     "release": "release-it",
+    "release:sbom": "pnpm exec cdxgen -t js --no-recurse --required-only -o packages/appkit/tmp/sbom.cdx.json packages/appkit && pnpm exec cdxgen -t js --no-recurse --required-only -o packages/appkit-ui/tmp/sbom.cdx.json packages/appkit-ui",
     "release:dry": "release-it --dry-run",
     "release:ci": "release-it --ci",
     "setup:repo": "./tools/setup.sh",
@@ -53,6 +54,7 @@
     "@biomejs/biome": "2.2.6",
     "@commitlint/cli": "19.8.1",
     "@commitlint/config-conventional": "19.8.1",
+    "@cyclonedx/cdxgen": "12.1.2",
     "@release-it/conventional-changelog": "10.0.4",
     "@testing-library/dom": "10.4.1",
     "@testing-library/react": "16.3.0",

packages/appkit-ui/package.json

@@ -19,7 +19,8 @@
     "llms.txt",
     "README.md",
     "DCO",
-    "NOTICE.md"
+    "NOTICE.md",
+    "sbom.cdx.json"
   ],
   "exports": {
     "./js": {

packages/appkit/package.json

@@ -21,7 +21,8 @@
     "llms.txt",
     "README.md",
     "DCO",
-    "NOTICE.md"
+    "NOTICE.md",
+    "sbom.cdx.json"
   ],
   "exports": {
     ".": {

packages/lakebase/.release-it.json

@@ -21,8 +21,9 @@
   },
   "npm": false,
   "hooks": {
+    "before:init": "pnpm audit --audit-level=high --prod",
     "after:bump": "npm version ${version} --no-git-tag-version --allow-same-version",
-    "before:release": "pnpm build:package && pnpm dist",
+    "before:release": "pnpm build:package && pnpm dist && pnpm release:sbom",
     "after:release": "npm publish ./tmp --access public --provenance"
   },
   "plugins": {

packages/lakebase/package.json

@@ -25,7 +25,8 @@
     "dist",
     "README.md",
     "LICENSE",
-    "DCO"
+    "DCO",
+    "sbom.cdx.json"
   ],
   "exports": {
     ".": {
@@ -45,7 +46,8 @@
     "typecheck": "tsc --noEmit",
     "release": "release-it",
     "release:dry": "release-it --dry-run",
-    "release:ci": "release-it --ci"
+    "release:ci": "release-it --ci",
+    "release:sbom": "pnpm exec cdxgen -t js --no-recurse --required-only -o tmp/sbom.cdx.json ."
   },
   "dependencies": {
     "@databricks/sdk-experimental": "0.16.0",