Build: Accept the reviewed SBOM action update.

[JJJ]

Summary

• Accept the reviewed anchore/sbom-action v0.24.3 pin alongside the current v0.24.2 pin.
• Require all five build and release SBOM uses to share one approved commit revision. Count every action reference, including tags, so an extra or unreviewed use fails the audit.
• Run the required native smoke matrix when the release audit changes. This unblocks Dependabot PR build(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 in the github-actions group #354 through the normal protected-branch checks.

Validation

• npm run test:frontend
• npm run test:architecture
• Focused negative check: an added anchore/sbom-action@v0.24.3 reference fails the audit.
• git diff --check

[Copilot]

Copilot review overview

🟡 Changes recommended

The audit can overlook additional unapproved SBOM action references.

Review effort: Balanced
Findings: 1

Open (1)

• Action reference checks miss unreviewed non-SHA references · New

What changed in this PR

Updates release auditing to permit the reviewed SBOM action revision while enforcing revision consistency.

Changes:

• Allows SBOM action versions v0.24.2 and v0.24.3.
• Requires five SBOM uses to share one approved revision.

File	Description
scripts/​audit-release.js	Updates SBOM action revision validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.