feat(ci): add CycloneDX SBOM generation to project CI pipeline

[Soner (shyim)]

Summary

• Generate CycloneDX SBOM from composer.lock during shopware-cli project ci
• Support configurable output path and dev dependency inclusion via .shopware-project.yml
• Emit CycloneDX 1.7 format with proper application metadata and tool attribution
• Add missing swx symlink to Arch Linux, Nix, NFPM, and Homebrew Cask packaging

Test plan

• go test ./cmd/project/ -run TestGenerateProjectSBOM — verifies default output (excludes dev deps)
• go test ./cmd/project/ -run TestGenerateProjectSBOMIncludeDev — verifies IncludeDev: true
• go test ./cmd/project/ -run TestGenerateProjectSBOMSkipsWhenLockMissing — verifies graceful skip
• go test ./internal/sbom/... — full CycloneDX generation coverage
• go vet ./... — no new issues

[chatgpt-codex-connector]

💡 Codex Review

shopware-cli/cmd/project/ci.go

Lines 113 to 115 in 6b0e43a

	composer.Cmd.Env = append(os.Environ(),
	"COMPOSER_AUTH="+token,
	)

Forward COMPOSER_AUTH through executor environment

This sets COMPOSER_AUTH on composer.Cmd.Env, which works for local execution but not for the Docker executor path introduced in this commit: DockerExecutor only forwards container env vars from its internal d.env map into docker compose exec -e ... (internal/executor/docker.go, baseArgs). As a result, project ci in environment.type: docker won't pass auth to Composer inside the container, so installs from private repositories can fail.

---

shopware-cli/cmd/project/project_worker.go

Line 107 in 6b0e43a

p.Cmd.Env = append(os.Environ(), fmt.Sprintf("MESSENGER_CONSUMER_NAME=%s-%d", baseName, index))

Pass messenger consumer name via executor WithEnv

In Docker mode this assigns MESSENGER_CONSUMER_NAME only to the host docker compose process, not to the process inside the container. The Docker executor injects container env via -e arguments from Executor.WithEnv(...), so workers started here can lose their per-worker consumer names and run with the same default name, which can cause consumer collisions when multiple workers are started.

---

shopware-cli/cmd/project/project_logs.go

Lines 149 to 155 in 6b0e43a

	ring := make([]string, 0, n)
	for scanner.Scan() {
	if len(ring) < n {
	ring = append(ring, scanner.Text())
	} else {
	copy(ring, ring[1:])
	ring[n-1] = scanner.Text()

Guard against non-positive --lines in log tailing

This ring-buffer logic panics for invalid --lines values: n < 0 panics at make([]string, 0, n), and n == 0 reaches ring[n-1] (index -1) once at least one line is scanned. A user can trigger this with project logs --lines 0 (or negative), so the command should validate n > 0 before building/using the buffer.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".