ci(security): add SBOM scan and release evidence

.gitlab-ci.yml

@@ -9,9 +9,15 @@ backend_verify:
     - pip install --no-cache-dir -r backend/requirements.txt pytest ruff bandit pip-audit
     - PYTHONPATH=backend python -m compileall -q backend/app
     - ruff check backend/app backend/tests
-    - PYTHONPATH=backend pytest -q backend/tests
+    - PYTHONPATH=backend pytest -q backend/tests --junitxml=backend-test-report.xml
     - bandit -q -r backend/app -lll
     - pip-audit -r backend/requirements.txt
+  artifacts:
+    reports:
+      junit: backend-test-report.xml
+    paths:
+      - backend-test-report.xml
+    expire_in: 180 days
 
 frontend_build:
   stage: build
@@ -20,3 +26,28 @@ frontend_build:
     - cd frontend
     - npm ci
     - npm run build
+  artifacts:
+    name: "qiji-frontend-$CI_COMMIT_SHORT_SHA"
+    paths:
+      - frontend/dist/
+    expire_in: 30 days
+
+backend_sbom:
+  stage: verify
+  image: python:3.12-slim
+  script:
+    - pip install --no-cache-dir cyclonedx-bom
+    - python -m cyclonedx_py requirements backend/requirements.txt --output-reproducible --of JSON -o sbom-backend.cdx.json
+  artifacts:
+    name: "qiji-sbom-$CI_COMMIT_SHORT_SHA"
+    paths:
+      - sbom-backend.cdx.json
+    expire_in: 180 days
+
+filesystem_security:
+  stage: verify
+  image:
+    name: aquasec/trivy:0.67.2
+    entrypoint: [""]
+  script:
+    - trivy fs --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL --scanners vuln,misconfig,secret .