[AAASM-3723] 🐛 (ci): Fix CycloneDX SBOM npm-ls tree check in release-node.yml

[Chisanan232]

Description

Fixes the node beta.5 release dry-run failure (run 28152202879). The failing step was Generate CycloneDX SBOM (inside the publish job), not the publish/provenance itself:

npm error missing: safe-publish-latest@^2.0.0, required by math-intrinsics@1.1.0
...
Error: npm-ls exited with errors: 1   (exit 254)

Root cause: the job installs with pnpm install --frozen-lockfile (pnpm's symlinked node_modules, no package-lock.json). @cyclonedx/cyclonedx-npm shells out to npm ls to walk the tree, which flags devDependencies of transitive deps (e.g. safe-publish-latest required by math-intrinsics) as "missing" and exits non-zero — aborting the release before publish.

Fix: pnpm dlx @cyclonedx/cyclonedx-npm --omit dev --ignore-npm-errors … — a production-only tree (the correct scope for a release SBOM) plus tolerance for the residual npm ls noise from pnpm's layout. This is purely the dependency-manifest step; the OIDC trusted-publish + SLSA provenance path is untouched.

Verified: re-ran the dry-run on this branch — the publish job is completed:success (run 28152672806); docs snapshot correctly skipped; nothing published.

Type of Change

• 🐛 Bug fix (CI)

Related Issues

• Closes AAASM-3723 · surfaced by the AAASM-3707 (node beta.5) GATE-2 dry-run

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

✅ Claude Code review — AAASM-3723 (node SBOM/npm-ls)

CI: all green — napi-build, test (18/20/22/24), module-smoke, quality, audit, CodeQL, SonarCloud, codecov/patch, coverage-and-analysis (17 pass / 0 fail). No acceptance-type failures.

Scope vs ticket: fixes the Generate CycloneDX SBOM step (inside the publish job) that failed the beta.5 dry-run — @cyclonedx/cyclonedx-npm shells out to npm ls, which on pnpm's symlinked node_modules flags devDependencies of transitive deps (safe-publish-latest req by math-intrinsics, etc.) as missing and exits non-zero. Fix = --omit dev --ignore-npm-errors (a production-only tree — correct scope for a release SBOM — tolerant of pnpm-layout npm-ls noise). OIDC trusted-publish + SLSA provenance path untouched, matching the ticket's "don't weaken publish integrity" AC.

Really fixes the release error? Yes — re-ran the beta.5 dry-run on this branch (run 28152672806) and the Publish @agent-assembly/sdk + 4 runtime sub-packages to npm job — the exact job that failed in run 28152202879 — is now success (docs snapshot correctly skipped; nothing published).

Verdict: ✅ Ready to approve & merge.