[AAASM-3722] 🐛 (ci): Fix + pin cyclonedx SBOM flag in release-python.yml

[Chisanan232]

Description

Fixes the python b5 release dry-run failure (run 28152201157) at Generate CycloneDX SBOM:

cyclonedx-py: error: unrecognized arguments: --outfile

Root cause: release-python.yml ran uvx --from cyclonedx-bom unpinned, so uvx pulled the latest cyclonedx-bom whose CLI dropped --outfile.

Fix: pin cyclonedx-bom==7.3.0 and use the current flag --output-file:
uvx --from cyclonedx-bom==7.3.0 cyclonedx-py environment .venv --output-format JSON --output-file sbom.cdx.json
Pinning prevents future CLI drift (the actual root cause).

Verified: re-ran the release dry-run on this branch — the Generate CycloneDX SBOM job is completed:success (run 28152618977). Nothing published (dry-run).

Type of Change

• 🐛 Bug fix (CI)

Related Issues

• Closes AAASM-3722 · surfaced by the AAASM-3706 (python b5) GATE-2 dry-run

🤖 Generated with Claude Code

[Chisanan232]

✅ Claude Code review — AAASM-3722 (python SBOM)

CI: all green — Analyze (python), CodeQL, Run tag → PEP 440 fixture suite, analyze (4 pass / 0 fail). No acceptance-type failures.

Scope vs ticket: fixes the Generate CycloneDX SBOM step that failed the b5 release dry-run with cyclonedx-py: error: unrecognized arguments: --outfile. Root cause = unpinned uvx --from cyclonedx-bom pulling a latest CLI that dropped --outfile. Fix = pin cyclonedx-bom==7.3.0 + use --output-file — addresses both the symptom (flag) and the cause (drift) per the ticket's AC.

Really fixes the release error? Yes — verified on the actual release workflow: re-ran the b5 dry-run on this branch (run 28152618977) and the Generate CycloneDX SBOM job — the exact job that failed in run 28152201157 — is now success. Nothing published (dry-run).

Verdict: ✅ Ready to approve & merge.