Polish sbom-diff-and-risk self-provenance docs

[stacknil]

Summary

• add a focused self-provenance guide for workflow-built sbom-diff-and-risk artifacts
• add a build-and-attest job that uploads wheel/sdist artifacts and publishes GitHub artifact attestations on trusted non-PR runs
• clean up packaging metadata and README wording for consistent consumer verification

Verification

• python -m build
• python -m pytest

[chatgpt-codex-connector]

💡 Codex Review

scientific-computing-toolkit/tools/sbom-diff-and-risk/src/sbom_diff_risk/policy_parser.py

Lines 33 to 35 in 2e6cbe1

	unknown_keys = sorted(set(payload) - _SUPPORTED_POLICY_KEYS)
	if unknown_keys:
	raise PolicyError(f"Invalid policy schema in {path}: unsupported keys: {', '.join(unknown_keys)}.")

Validate policy keys as strings before unknown-key formatting

When a policy file has non-string top-level keys (which YAML allows), this path can raise a TypeError while sorting/joining unknown keys, so the CLI emits a traceback instead of the documented PolicyError/exit code 2 flow. This is user-visible on malformed policies and should fail cleanly with a schema error rather than crashing.

---

scientific-computing-toolkit/tools/sbom-diff-and-risk/src/sbom_diff_risk/policy_parser.py

Lines 47 to 49 in 2e6cbe1

	max_added_packages = payload.get("max_added_packages")
	if max_added_packages is not None and (not isinstance(max_added_packages, int) or max_added_packages < 0):
	raise PolicyError(f"Invalid policy schema in {path}: max_added_packages must be a non-negative integer.")

Reject boolean values for max_added_packages

The schema check uses isinstance(max_added_packages, int), but YAML booleans deserialize to bool, which is an int subclass in Python. A policy like max_added_packages: false is accepted and treated as 0, causing unexpected blocking violations whenever any package is added. This should be rejected as invalid schema input.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".