fix(ci): pin sbom.yml actions to SHA and scope permissions to the job

[rajnisht7]

What

sbom.yml pin anchore/sbom-action, actions/checkout, and actions/upload-artifact to commit SHAs, and scope contents: write / id-token: write to the sbom job instead of the whole workflow file.

Why

Part of the CI hardening pass in agentrust-io/.github#30.

Security impact

None

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

Manual Steps:

• Validated sbom.yml with yaml.safe_load() parses without errors
• Verified each pinned commit SHA against git ls-remote --tags to confirm it matches the version comment (actions/checkout -> v7.0.1, anchore/sbom-action -> v0.24.0, actions/upload-artifact -> v7.0.1)
• Diffed against the previous version to confirm no functional/step changes only version pinning and permission scope changed

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[imran-siddique]

Verified every SHA at source rather than trusting the version comments, since a wrong SHA in a pinning PR is worse than no pin: it looks pinned, passes review, and nobody re-checks it.

pin	tag	result
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	v7.0.1	exact
actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065	v5.6.0	exact
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	v7.0.1	exact
anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610	v0.24.0	exact

Annotated tags dereferenced to their commits where needed, which is the step that makes a codeql-style pin look wrong when it is right.

The permissions change is the part I would have asked for if it were missing. Moving contents: write and id-token: write from workflow scope to job scope narrows them to the job that needs them, so every other job in that file drops to the default. id-token: write in particular is the one worth scoping tightly, since it mints OIDC tokens. Doing that in the same PR as the pinning is coherent rather than scope creep: both are about what a compromised step can reach.

Keeping the # vX.Y.Z comment beside each SHA is what makes this maintainable. A bare SHA is unreadable and gets bumped by someone pasting a newer one without checking what it is. Saying explicitly in the .github note that the SHA and the comment must be updated together is the instruction that keeps them from drifting apart.

Replicating the identical change across ca2a, cmcp and trace-spec as separate PRs rather than one is right for repos that do not share a workflow file. They are byte-identical, which I checked.

Merged.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!