ci: add CodeQL SAST, CycloneDX SBOM, and build attestations#470

Merged

jcputney merged 6 commits intomainfrom

claude/add-sast-sca-sbom-CUirM

May 6, 2026

Commits on May 6, 2026

ci: split attestation into a separate job to isolate OIDC permissions
claude
committed
ci: fix release attestation provenance and remove staging from release job

Copilot
and
jcputney
authored