fix(workflows): prevent zero-diff force-push, fix SBOM attestation, and consolidate security collection

[WilliamBerryiii]

Description

This PR addresses five issues discovered after the stable 3.2.0 release: pre-release pipeline failures, SBOM attestation errors, missing pre-release SBOM generation, an incorrectly re-created security-planning collection, and dependency review license false positives.

Pre-release pipeline zero-diff force-push (#1160)

Both release-prerelease-pr.yml and release-stable.yml used the GitHub API to force-push prerelease/next to the same SHA as main. GitHub detected 0-diff and auto-closed the open PR. The reset-prerelease job also ran git/gh commands without checkout.

Fix: Replaced API-based force-push with atomic git checkout -B + git push --force to create a version-bump commit. Added actions/checkout with fetch-depth: 0 to the reset-prerelease job. Added -R flag to gh CLI commands. Split the combined update step into separate reset and create-or-update PR steps.

Stable release SBOM attestation failure (#1161)

The dependency SBOM was downloaded to ./dist alongside VSIX files, but attestation expected it at ./sbom/dependency-sbom.spdx.json.

Fix: Isolated dependency SBOM download to ./sbom directory. Corrected sbom-path references. Added file-existence verification guards before all attestation steps.

Pre-release pipeline missing SBOM (#1162)

The pre-release pipeline had no dependency SBOM generation or attestation, unlike the stable pipeline.

Fix: Added generate-dependency-sbom job using anchore/sbom-action with sparse checkout. Added per-VSIX SBOM generation, VSIX filename resolution, and SBOM attestation steps. Added artifact-metadata: write permission and expanded release asset uploads.

security-planning collection consolidation (#1163)

PR #980 renamed security-planning to security. PR #979 then incorrectly re-created security-planning as a separate collection for SSSC artifacts.

Fix: Moved all files from security-planning/ and sssc-planning/ directories into security/. Updated all path references across collection YAMLs, agent files, marketplace.json, and documentation. Deleted security-planning collection manifests and plugin outputs. Regenerated all plugins.

Dependency review license false positives (#1164)

The dependency-review.yml workflow failed on PRs adding Python skill dependencies because lxml (BSD-3-Clause) and typing-extensions (PSF-2.0) were mis-labeled as GPL by the scanner due to compound SPDX expressions in their source distributions.

Fix: Added per-package license exemptions via allow-dependencies-licenses for pkg:pypi/lxml and pkg:pypi/typing-extensions. Added missing license identifiers (MIT-0, MIT-CMU, HPND, LicenseRef-scancode-secret-labs-2011) to the global allow-list. Deduplicated PRE_VERSION calculation in release-stable.yml and added least-privilege comments to SBOM job permissions.

Related Issue(s)

Fixes #1160
Fixes #1161
Fixes #1162
Fixes #1163
Fixes #1164

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• YAML lint passed (43/43 workflow files)
• Plugin generation: 12 collections, 0 errors
• Plugin validation: 12 collections validated, 0 errors
• Manual review of all workflow files for consistent atomic branch reset pattern
• Verified all added action references use pinned 40-character commit SHAs with version comments
• Grep validation: zero stale security-planning/ or sssc-planning/ references remain in live files

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Plugin freshness: npm run plugin:generate

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

All new action references use fully pinned SHA references. Defensive test -f guards gate SBOM attestation steps. Sparse checkout limits clone surface. SBOM attestation uses actions/attest for supply chain integrity. The security-planning marketplace extension entry has been removed. Dependency review license exemptions use per-package allow-dependencies-licenses rather than adding GPL to the global allow-list.

Additional Notes

Breaking change: The security-planning collection and its marketplace extension no longer exist. All artifacts are now in the security collection. Consumers of the security-planning extension should switch to the security extension.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.89%. Comparing base (c5cca83) to head (67096d5).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1159      +/-   ##
==========================================
- Coverage   86.90%   86.89%   -0.02%     
==========================================
  Files          59       59              
  Lines        8774     8774              
==========================================
- Hits         7625     7624       -1     
- Misses       1149     1150       +1     

Flag	Coverage Δ
pester	85.32% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Dependency Review Summary

The full dependency review summary was too large to display here (1553KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary