fix(wizard): pin emitted action ref to the latest GitHub release SHA

[vpetersson]

Problem

The wizard-emitted workflow could contain an invalid, unpinned action reference:

- uses: sbomify/sbomify-action@v26.7.0+ad3dc1d

(seen in Screenly/Anthias#3186, flagged by SonarCloud: "Use full commit SHA hash for this dependency").

Two failures compounded:

1. The uses: ref was derived from the running build's __version__. Dev/Docker builds report a PEP 440 local version like 26.7.0+ad3dc1d, so the GitHub tag→SHA lookup 404'd and no SHA pin was emitted.
2. The offline fallback then emitted the raw version string verbatim — a ref that can't exist as a tag (there is no v26.7.0 tag on GitHub at all; the newest release is v26.2.0).

Fix

• resolve_action_ref() now asks GitHub for the latest published release (/releases/latest) and pins to that release's full commit SHA: sbomify/sbomify-action@<full-sha> # <release-tag>. It never assumes the built version exists as a tag.
• Only when GitHub is unreachable does it default to the version we built, tag-pinned — and _action_version() now strips the +local build-metadata segment so the fallback is @v26.7.0, never @v26.7.0+ad3dc1d.
• Release tags from the API are sanity-checked (plain tag characters only) before landing verbatim in emitted YAML.

Testing

• New tests for the release lookup (online / offline / 404 / bad JSON / non-dict JSON / unsafe tag), local-version stripping, and latest-release-preferred resolution; conftest's offline fixture now stubs both network boundaries.
• Full suite: 2429 passed, 4 skipped. Ruff lint + format clean.
• Exercised live against GitHub: resolves to sbomify/sbomify-action@ac8b0d423c90447f3011ef8ab5f9ff2e854c6931 # v26.2.0.

Note for maintainers

GitHub releases currently stop at v26.2.0 while PyPI is at 26.7.0 — until a release is published for the current version, the wizard will (correctly) pin to v26.2.0's commit.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes the wizard’s emitted uses: reference for sbomify/sbomify-action so it is reliably SHA-pinned to a valid GitHub release commit (even when the running build version is a dev/local PEP 440 version that does not correspond to any GitHub tag).

Changes:

• Resolve the action ref by querying GitHub’s latest published release tag and pinning the emitted workflow to that release’s full commit SHA.
• Strip PEP 440 local-version metadata (+...) from the build version so the offline fallback never emits an invalid tag ref.
• Add tests covering latest-release lookup behavior and the new resolution/fallback paths; update the global offline test fixture to stub both network boundaries.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
sbomify_action/cli/wizard/ci_emitter.py	Adds latest-release tag resolution + tag sanitization; updates action-ref resolution to prefer latest release and strips local version metadata for offline fallback.
tests/test_wizard_emitter.py	Adds unit tests for local-version stripping, latest-release tag resolution edge cases, and latest-release SHA pinning behavior.
tests/conftest.py	Extends the autouse offline fixture to stub both the latest-release and tag→SHA GitHub lookups to prevent network calls.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.