chore: add sbom config

[MateuszMatyska]

Pull Request

Description

ISO 27001 requirement

Setup of SBOM.

A Software Bill of Materials (SBOM) is essentially a detailed inventory of all the components and dependencies that make up a software application. It's like a comprehensive list of ingredients for software, specifying everything from open-source libraries and frameworks to third-party modules and their respective versions. SBOMs are crucial for enhancing software security and supply chain risk management by providing transparency and enabling organizations to identify and address potential vulnerabilities.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test addition/update

Related Issues

Changes Made

Testing

Test Results

# Paste test output here
make test
# ...

Checklist

• My code follows the project's code style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have updated the documentation accordingly
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Pre-commit checks pass (make pre-commit)
• I have updated CHANGELOG.md (if applicable)

Screenshots (if applicable)

Additional Notes

[Copilot]

Pull request overview

Adds SBOM and security/license scanning to the existing GitHub Actions CI workflow to support ISO 27001 compliance requirements.

Changes:

• Introduces a new sbom_scan job that generates a CycloneDX SBOM via Syft and scans it with Grype.
• Adds ORT execution and uploads SBOM / vulnerability / ORT outputs as workflow artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.