fix(sbom): add CycloneDX report

    - mkdir -p -m 777 reports

    - npx -y @cyclonedx/cyclonedx-npm${NG_SBOM_VERSION:+@$NG_SBOM_VERSION} --output-format JSON --output-file reports/ng-sbom.cyclonedx.json $NG_SBOM_OPTS

    - chmod a+r reports/ng-sbom.cyclonedx.json

  rules:

    # exclude if disabled

    - if: '$NG_SBOM_DISABLED == "true"'

      when: never

    - !reference [.test-policy, rules]

  artifacts:

    name: "SBOM for Angular from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

    when: always

    expire_in: 1 week

    paths:

      - $NG_WORKSPACE_DIR/reports/ng-sbom.cyclonedx.json

    reports:

      cyclonedx: 

        - $NG_WORKSPACE_DIR/reports/ng-sbom.cyclonedx.json

  rules:

    # exclude if disabled

    - if: '$NG_SBOM_DISABLED == "true"'

      when: never

    - !reference [.test-policy, rules]

###############################################################################################

#                                      publish stage:                                         #