[ITSEC-2280] Add Dependency Review and SBOM signing jobs, update CODEOWNERS

.github/workflows/publish.yaml

@@ -9,6 +9,8 @@ jobs:
   publish:
     name: Publish to NPM
     runs-on: ubuntu-latest
+    permissions:
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@v2
@@ -58,6 +60,11 @@ jobs:
         run: |
           rm -rf dist && yarn build
 
+      - name: Generate SDK attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: './dist'
+
       - name: Publish package
         uses: JS-DevTools/npm-publish@v1
         with:

.github/workflows/test.yml

@@ -92,6 +92,16 @@ jobs:
         uses: actions/checkout@v3
       - name: Run check script
         run: sh readmecheck.sh
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: 'Checkout Repository'
+      uses: actions/checkout@v4
+    - name: Dependency Review
+      uses: actions/dependency-review-action@v4
+      with:
+        # Possible values: "critical", "high", "moderate", "low"
+        fail-on-severity: critical
   publish:
     name: Publish to NPM (dry run)
     runs-on: ubuntu-latest

CODEOWNERS

@@ -1,3 +1,5 @@
+.github @immutable/assets @immutable/traders @immutable/prodsec
+
 /clients @immutable/assets
 /abi @immutable/assets