refactor(build): track third-party notices deterministically + add CI SBOM (#978)

The bundled dist/ is committed and redistributes ~214 production dependencies,
so their license notices must ship alongside it. The generated notice file sat
in limbo — produced on every build, committed by the release pipeline, deleted
by Renovate commits, excluded from the CI dist-diff check for renovate branches,
and never gitignored — so it perpetually showed as untracked.

- Rename dist/licenses.txt to dist/THIRD_PARTY_NOTICES.txt and commit it as the
  tracked attribution for the bundled dependencies. Generation is already
  deterministic (stable sort, normalized line endings); a total license-collection
  failure now fails the build instead of silently writing nothing, while benign
  per-dependency gaps still produce the file.
- Remove the renovate-branch carve-out from the dist/ comparison so every branch
  verifies the notice file like the rest of dist/.
- Generate a CycloneDX dependency SBOM in CI via pnpm sbom and upload it as a
  build artifact.

Extract formatThirdPartyNotices() as a pure, tested helper.

Author: marcusrbrown

.github/workflows/ci.yaml

@@ -95,13 +95,9 @@ jobs:
         run: pnpm build
       - name: Compare the expected and actual dist/ directories
         run: |
-          DIFF_TARGETS="dist/"
-          if [[ "${{ github.head_ref || github.ref_name }}" == renovate/* ]]; then
-            DIFF_TARGETS="dist/ ':!dist/licenses.txt'"
-          fi
-          if [ "$(eval git diff --ignore-space-at-eol $DIFF_TARGETS | wc -l)" -gt "0" ]; then
+          if [ "$(git diff --ignore-space-at-eol dist/ | wc -l)" -gt "0" ]; then
             echo "Detected uncommitted changes after build.  See status below:"
-            eval git diff --text $DIFF_TARGETS
+            git diff --text dist/
             exit 1
           fi
         id: diff
@@ -111,6 +107,17 @@ jobs:
         with:
           name: dist
           path: dist/
+      # The SBOM is an informational artifact, not a build gate — a generation
+      # failure must not fail the build.
+      - name: Generate the dependency SBOM
+        id: sbom
+        continue-on-error: true
+        run: pnpm sbom --sbom-format cyclonedx --prod > sbom.cdx.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ steps.sbom.outcome == 'success' }}
+        with:
+          name: sbom-cyclonedx
+          path: sbom.cdx.json
 
   test:
     name: Test

RULES.md

@@ -730,7 +730,8 @@ lint-staged        # Runs on staged files
 - **Bundle (setup)**: `dist/setup.js` (ESM, minified)
 - **Bundle (post)**: `dist/post.js` (ESM, minified) - post-action cache hook
 - **Bundle (plugin)**: `dist/plugin/fro-bot-agent.js` (ESM, self-contained)
-- **Licenses**: `dist/licenses.txt` (auto-extracted)
+- **Third-party notices**: `dist/THIRD_PARTY_NOTICES.txt` (auto-generated, committed attribution for the bundled dependencies)
+- **SBOM**: a CycloneDX dependency SBOM is generated in CI (`pnpm sbom`) and uploaded as a build artifact (not committed)
 - **Source maps**: Not included in production
 
 ### dist/ Directory Rules