ci(security): consolidate SBOM schedule

.github/workflows/sbom-generation.yml

@@ -15,9 +15,16 @@ on:
       - 'packages/**'
       - 'apps/**'
       - 'src/**'
-  schedule:
-    # Run weekly to reduce cost (Mon 05:40 UTC)
-    - cron: '40 5 * * 1'
+  workflow_call:
+    inputs:
+      include_vulnerabilities:
+        description: 'Include vulnerability scanning'
+        required: false
+        default: true
+        type: boolean
+    secrets:
+      DEPENDENCY_TRACK_API_KEY:
+        required: false
   workflow_dispatch:
     inputs:
       include_vulnerabilities:
@@ -58,11 +65,19 @@ jobs:
       run: node scripts/ci/check-bins.mjs
 
     - name: Generate SBOM (JSON format)
+      env:
+        INCLUDE_VULNS: ${{ inputs.include_vulnerabilities }}
+        INCLUDE_VULNS_FALLBACK: ${{ github.event.inputs.include_vulnerabilities }}
       run: |
+        INCLUDE="${INCLUDE_VULNS:-${INCLUDE_VULNS_FALLBACK:-true}}"
+        EXTRA=""
+        if [ "$INCLUDE" = "true" ]; then
+          EXTRA="--include-vulns"
+        fi
         pnpm run ae-framework sbom generate \
           --format json \
           --include-dev-deps \
-          ${{ github.event.inputs.include_vulnerabilities == 'true' && '--include-vulns' || '' }} \
+          $EXTRA \
           --output sbom.json \
           --verbose
 

.github/workflows/security.yml

@@ -222,6 +222,21 @@ jobs:
           path: license-summary.txt
           retention-days: 30
 
+  sbom-generation:
+    name: SBOM Generation (schedule/dispatch)
+    needs: gate
+    if: ${{ needs.gate.outputs.run_security == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+    uses: ./.github/workflows/sbom-generation.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+      id-token: write
+      attestations: write
+    with:
+      include_vulnerabilities: true
+
   security-policy-check:
     name: Security Policy Validation
     runs-on: ubuntu-latest