ci: release SBOM + build provenance + CODEOWNERS

[devopam]

Summary

The genuinely-additive remnant of the now-closed #306, rebuilt cleanly on current main (0.7.1). #306 was based on a stale 0.6.12 base and mostly duplicated the 0.7.x security work already on main (Actions SHA-pinning, ci.yml least-privilege, Docker digest pinning, the cryptography bump). Only three items were still missing — those are here:

1. Release SBOM — the build job generates a CycloneDX SBOM (cyclonedx-bom, new dev dep) from the locked runtime deps and attaches it to the GitHub release. Kept out of dist/ so the PyPI upload (dist/*) is unaffected.

2. Build provenance — actions/attest-build-provenance (SHA-pinned) attests the wheel + sdist: GitHub-native, gh attestation verify-able provenance that complements the PEP 740 attestations PyPI Trusted Publishing already emits. Adds attestations: write to the build job only.

3. CODEOWNERS — routes the SQL-safety kernel, access-mode policy, and CI/release pipeline to the maintainer (enables "Require review from Code Owners" branch protection if you want it).

Validation

• ✅ publish.yml YAML-valid; uv sync --locked consistent after the new dev dep
• ✅ SBOM generation tested locally — CycloneDX 1.6, 46 components
• ⚠️ The SBOM + attestation steps run only on a tag release, so PR CI can't exercise them — they'll be validated on the next release. No ci.yml change, so the rest of CI is unaffected.

Not included (already on main)

Actions SHA-pinning, ci.yml permissions, Docker digest pinning, cryptography 50.0.0 — all already shipped in 0.7.x.

Roadmap linkage

Advances roadmap row: N/A — CI/supply-chain hardening.

Checklist

• Tests added/updated first — N/A (CI/build only); SBOM gen verified locally
• ruff, ruff format, and mypy src/mcpg pass — no source change
• CHANGELOG.md updated under [Unreleased]
• Roadmap row cited above (or N/A)
• No hand-edits to src/mcpg/_vendor/

🤖 Generated with Claude Code

https://claude.ai/code/session_0122yLZLJ8t4W43sdN6BmTZc

---

Generated by Claude Code

Summary by Sourcery

Add SBOM generation and build provenance attestation to the release workflow and introduce code ownership routing for critical areas.

New Features:

• Generate a CycloneDX SBOM for runtime dependencies during tagged release builds and attach it to GitHub releases.
• Produce GitHub-native build provenance attestations for sdist and wheel artifacts in the publish workflow.
• Define CODEOWNERS to route SQL-safety, access policy, and CI/release files to the maintainer.

Enhancements:

• Adjust publish workflow permissions and artifact handling to support SBOM generation and provenance attestations.
• Document the new SBOM, provenance, and CODEOWNERS changes in the unreleased changelog section.

Build:

• Add cyclonedx-bom as a development dependency for SBOM generation in the publish pipeline.

CI:

• Extend the publish GitHub Actions workflow with SBOM generation, attestation steps, and artifact wiring for release creation.

Documentation:

• Update CHANGELOG to describe the new release SBOM, build provenance, and CODEOWNERS setup.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}