feat(refactor-release): publish release SBOMs - #12869
Draft
DariuszPorowski wants to merge 2 commits into
Draft
DariuszPorowski wants to merge 2 commits into
DariuszPorowski wants to merge 2 commits into
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
August 28, 2026 18:36
e17cf14 to
8f308d4
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/goreleaser-tag-cutover #12869 +/- ##
============================================================
Coverage ? 59.51%
============================================================
Files ? 772
Lines ? 45053
Branches ? 0
============================================================
Hits ? 26815
Misses ? 18238
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests 0 ✅ 5m 4s ⏱️ For more details on these failures, see this check. Results for commit 38af438. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
3 times, most recently
from
August 28, 2026 20:17
a04b9ae to
798f05c
Compare
DariuszPorowski
changed the title
2 tasks
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 3, 2026 16:22
798f05c to
2cf1ed0
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 9, 2026 17:41
2cf1ed0 to
65ee3a7
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 9, 2026 20:47
65ee3a7 to
7b08416
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The release gates accept schema-invalid SPDX documents, and the claimed deterministic output is not currently produced.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds SPDX SBOM generation and release verification for CLI binaries and production images.
Changes:
- Configures Syft and GoReleaser SBOM generation.
- Adds release gates and contract tests for SBOM assets and attestations.
- Documents SBOM discovery and inspection.
File summaries
| File | Description |
|---|---|
.cspellignore |
Allows the Anchore name. |
.goreleaser.yaml |
Configures CLI and image SBOMs. |
.github/scripts/release-assets.mjs |
Verifies published CLI SBOMs. |
.github/scripts/release-assets_test.mjs |
Tests release SBOM verification. |
.github/scripts/release-oci-artifacts.sh |
Verifies image attestations. |
.github/scripts/release-oci-artifacts_test.sh |
Tests image SBOM validation. |
.github/scripts/release-parity-manifest.sh |
Permits expected SBOM assets. |
.github/scripts/release-parity-manifest_test.sh |
Tests parity classification. |
.github/scripts/release-sboms_test.sh |
Adds SBOM contract tests. |
.github/scripts/verify-goreleaser-snapshot.sh |
Validates generated SBOM output. |
.github/workflows/build-release.yaml |
Gates releases on SBOM checks. |
.github/workflows/goreleaser-snapshot.yaml |
Installs Syft and retains SBOMs. |
build/scripts/install-syft.sh |
Installs checksum-verified Syft. |
build/test.mk |
Adds SBOM tests to the test graph. |
build/tools.generated.mk |
Defines generated Syft pins. |
build/tools.mk |
Adds the Syft installation target. |
build/tools.yaml |
Pins Syft release artifacts. |
docs/contributing/contributing-releases/README.md |
Documents release SBOM usage. |
Review details
- Files reviewed: 18/18 changed files
- Comments generated: 4
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+78
to
+90
| typeof document !== "object" || | ||
| document === null || | ||
| !/^SPDX-2\.\d+$/.test(document.spdxVersion) || | ||
| document.SPDXID !== "SPDXRef-DOCUMENT" || | ||
| document.dataLicense !== "CC0-1.0" || | ||
| typeof document.documentNamespace !== "string" || | ||
| !document.documentNamespace.startsWith("https://") || | ||
| typeof document.creationInfo?.created !== "string" || | ||
| !Array.isArray(creators) || | ||
| !creators.some((creator) => /^Tool: syft-/.test(creator)) || | ||
| !Array.isArray(document.packages) || | ||
| document.packages.length === 0 || | ||
| !Array.isArray(document.relationships) |
Comment on lines
+695
to
+707
| | ($document | type == "object") | ||
| and ($document.spdxVersion | ||
| | type == "string" and test("^SPDX-2\\.[0-9]+$")) | ||
| and $document.SPDXID == "SPDXRef-DOCUMENT" | ||
| and $document.dataLicense == "CC0-1.0" | ||
| and ($document.documentNamespace | ||
| | type == "string" and startswith("https://")) | ||
| and ($document.creationInfo.created | ||
| | type == "string" and length > 0) | ||
| and any($document.creationInfo.creators[]?; | ||
| startswith("Tool: syft-")) | ||
| and ($document.packages | type == "array" and length > 0) | ||
| and ($document.relationships | type == "array") |
Comment on lines
+100
to
+112
| jq -e ' | ||
| type == "object" | ||
| and (.spdxVersion | ||
| | type == "string" and test("^SPDX-2\\.[0-9]+$")) | ||
| and .SPDXID == "SPDXRef-DOCUMENT" | ||
| and .dataLicense == "CC0-1.0" | ||
| and (.documentNamespace | ||
| | type == "string" and startswith("https://")) | ||
| and (.creationInfo.created | type == "string" and length > 0) | ||
| and any(.creationInfo.creators[]?; startswith("Tool: syft-")) | ||
| and (.packages | type == "array" and length > 0) | ||
| and (.relationships | type == "array") | ||
| ' "${file}" >/dev/null || fail "invalid SPDX JSON SBOM: ${file}" |
Comment on lines
+118
to
+123
| args: | ||
| - "${artifact}" | ||
| - --output | ||
| - "spdx-json=${document}" | ||
| - --enrich | ||
| - golang |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 19:28
7b08416 to
c3bea33
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 20:32
c3bea33 to
0f85bee
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 15, 2026 22:59
91ccc77 to
530b434
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 17, 2026 21:12
530b434 to
3ee84a2
Compare
DariuszPorowski
removed this pull request from stack #12738
September 17, 2026 21:54
DariuszPorowski
added this pull request to stack #13045
September 17, 2026 21:56
DariuszPorowski
removed this pull request from stack #13045
September 18, 2026 20:12
DariuszPorowski
added this pull request to stack #13056
September 18, 2026 20:12
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 18, 2026 20:32
3ee84a2 to
88660c4
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
3 times, most recently
from
September 18, 2026 22:04
ee1f481 to
9c88914
Compare
DariuszPorowski
removed this pull request from stack #13056
September 18, 2026 22:57
DariuszPorowski
added this pull request to stack #13058
September 18, 2026 22:59
DariuszPorowski
removed this pull request from stack #13058
September 18, 2026 23:05
DariuszPorowski
added this pull request to stack #13060
September 18, 2026 23:06
DariuszPorowski
removed this pull request from stack #13060
September 19, 2026 02:21
DariuszPorowski
added this pull request to stack #13063
September 19, 2026 02:21
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 19, 2026 02:30
9c88914 to
830b2bc
Compare
Generate SPDX JSON SBOMs for every raw rad binary with a pinned, checksum-verified Syft release, and publish them as additive GitHub Release assets without changing the existing binary checksum contract. Enable BuildKit SBOM attestations on every GoReleaser production image and require one valid SPDX document for each locked platform before finalization. Recheck CLI and image SBOMs when reconciling an already published release. Classify the seven CLI SBOM files as intentional parity additions, retain them with GoReleaser workflow metadata, and document how to find both release assets and per-platform image attestations. Refs: #12818 Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
…on review notes Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 19, 2026 03:47
830b2bc to
38af438
Compare
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
DariuszPorowski
removed this pull request from stack #13063
September 21, 2026 16:26
DariuszPorowski
added this pull request to stack #13074
September 21, 2026 16:26
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Generate SPDX JSON SBOMs for all seven raw
radrelease binaries with checksum-verified Syft v1.51.1, and attach per-platform SPDX SBOM attestations to the five GoReleaser production images.Verify the exact CLI SBOM asset set and document structure on draft and published releases. Verify one image attestation per locked production platform before image locking, finalization, and published-release reconciliation. Existing binary names and checksum assets remain unchanged.
This stacked PR depends on #12828.
Draft gate: keep this PR in draft until one RC draft release contains all seven well-formed CLI SBOM assets and valid attestations for every production-image platform.
Reason for change
PR13 made GoReleaser authoritative for core release artifacts. This additive follow-up uses its native Syft and
dockers_v2integration to expose dependency inventories without creating a parallel publishing path or weakening the existing parity contract.Fixes #12818
How to test
make goreleaser-snapshot GORELEASER_ARGS="--skip=docker"built all 22 targets, generated seven SPDX 2.3 CLI SBOMs, generated no unintended SBOM checksum sidecars, and passed the enhanced output verifier.bash .github/scripts/release-sboms_test.shbash .github/scripts/release-oci-artifacts_test.sh(14 tests, including missing and malformed image attestations)bash .github/scripts/release-parity-manifest_test.shnode --test .github/scripts/release-assets_test.mjs(15 tests)The image-attestation path is covered locally with deterministic Buildx fixtures. A real registry publication remains the draft exit criterion above.
File change summary
.goreleaser.yamlbuild/tools.yaml,build/tools.generated.mk,build/tools.mk,build/scripts/install-syft.sh.github/workflows/{goreleaser-snapshot,build-release}.yaml.github/scripts/{verify-goreleaser-snapshot,release-assets,release-oci-artifacts,release-parity-manifest}*.github/scripts/release-sboms_test.sh,build/test.mkdocs/contributing/contributing-releases/README.mdeng/design-notes/tools/2026-09-goreleaser-stack-review/pr-14-goreleaser-sboms.md