Update: [Dependency_Graph_SBOM_Cheat_Sheet] Modernize CI/CD signing example and add scan/attestation/publish steps

What is missing or needs to be updated?

The "Practical CI/CD snippets & patterns" section has a good GitHub Actions example (generate SBOM with syft → sign with cosign), but it's incomplete and one part is out of date with current Sigstore best practice:

1. Cosign key handling is outdated. The example signs with a static key pair via --key ${{ secrets.COSIGN_KEY }}. Sigstore's current recommended pattern is keyless signing via GitHub OIDC (id-token: write permission, no stored key), which removes the key-rotation burden the cheat sheet's own "SBOM quality pitfalls" and general Secrets Management guidance would otherwise flag as a risk.

2. No vulnerability scan step. The section lists Grype as a recommended scanner earlier in the doc, but the CI example never actually runs it against the generated SBOM or gates the build on results.

3. No provenance attestation step. The doc mentions in-toto/SLSA attestation conceptually in "Bind SBOM to artifacts," but the CI example only signs the SBOM as a blob — it doesn't show a cosign attest step producing an actual provenance predicate.

4. No SBOM publish step. "Ingesting & managing SBOMs at scale" recommends Dependency-Track, and "Example workflows" describes the ingest flow narratively, but there's no CI snippet showing the actual upload (e.g., a curl/API call to a Dependency-Track instance).

How should this be resolved?

Update the existing GitHub Actions example in "Practical CI/CD snippets & patterns" to:

• Switch the cosign step to keyless/OIDC signing
• Add a Grype scan step with a severity threshold that fails the job
• Add a cosign attest step with an SLSA/in-toto predicate
• Add a step publishing the SBOM to Dependency-Track via its REST API

This closes the gap between what the doc recommends narratively and what the sample pipeline actually demonstrates.

I'm happy to submit a PR with the updated YAML if this is acknowledged.