feat(refactor-release): publish release SBOMs - #12869
Draft
DariuszPorowski wants to merge 2 commits into
Draft
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
August 28, 2026 18:36
e17cf14 to
8f308d4
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/goreleaser-tag-cutover #12869 +/- ##
=============================================================
- Coverage 59.77% 59.77% -0.01%
=============================================================
Files 778 778
Lines 45916 45916
=============================================================
- Hits 27446 27445 -1
- Misses 18470 18471 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests ±0 0 ✅ ±0 5m 5s ⏱️ ±0s For more details on these failures, see this check. Results for commit 3a86a49. ± Comparison against base commit 03b039a. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
3 times, most recently
from
August 28, 2026 20:17
a04b9ae to
798f05c
Compare
DariuszPorowski
changed the title
2 tasks
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 3, 2026 16:22
798f05c to
2cf1ed0
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 9, 2026 17:41
2cf1ed0 to
65ee3a7
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 9, 2026 20:47
65ee3a7 to
7b08416
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The release gates accept schema-invalid SPDX documents, and the claimed deterministic output is not currently produced.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds SPDX SBOM generation and release verification for CLI binaries and production images.
Changes:
- Configures Syft and GoReleaser SBOM generation.
- Adds release gates and contract tests for SBOM assets and attestations.
- Documents SBOM discovery and inspection.
File summaries
| File | Description |
|---|---|
.cspellignore |
Allows the Anchore name. |
.goreleaser.yaml |
Configures CLI and image SBOMs. |
.github/scripts/release-assets.mjs |
Verifies published CLI SBOMs. |
.github/scripts/release-assets_test.mjs |
Tests release SBOM verification. |
.github/scripts/release-oci-artifacts.sh |
Verifies image attestations. |
.github/scripts/release-oci-artifacts_test.sh |
Tests image SBOM validation. |
.github/scripts/release-parity-manifest.sh |
Permits expected SBOM assets. |
.github/scripts/release-parity-manifest_test.sh |
Tests parity classification. |
.github/scripts/release-sboms_test.sh |
Adds SBOM contract tests. |
.github/scripts/verify-goreleaser-snapshot.sh |
Validates generated SBOM output. |
.github/workflows/build-release.yaml |
Gates releases on SBOM checks. |
.github/workflows/goreleaser-snapshot.yaml |
Installs Syft and retains SBOMs. |
build/scripts/install-syft.sh |
Installs checksum-verified Syft. |
build/test.mk |
Adds SBOM tests to the test graph. |
build/tools.generated.mk |
Defines generated Syft pins. |
build/tools.mk |
Adds the Syft installation target. |
build/tools.yaml |
Pins Syft release artifacts. |
docs/contributing/contributing-releases/README.md |
Documents release SBOM usage. |
Review details
- Files reviewed: 18/18 changed files
- Comments generated: 4
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+78
to
+90
| typeof document !== "object" || | ||
| document === null || | ||
| !/^SPDX-2\.\d+$/.test(document.spdxVersion) || | ||
| document.SPDXID !== "SPDXRef-DOCUMENT" || | ||
| document.dataLicense !== "CC0-1.0" || | ||
| typeof document.documentNamespace !== "string" || | ||
| !document.documentNamespace.startsWith("https://") || | ||
| typeof document.creationInfo?.created !== "string" || | ||
| !Array.isArray(creators) || | ||
| !creators.some((creator) => /^Tool: syft-/.test(creator)) || | ||
| !Array.isArray(document.packages) || | ||
| document.packages.length === 0 || | ||
| !Array.isArray(document.relationships) |
Comment on lines
+695
to
+707
| | ($document | type == "object") | ||
| and ($document.spdxVersion | ||
| | type == "string" and test("^SPDX-2\\.[0-9]+$")) | ||
| and $document.SPDXID == "SPDXRef-DOCUMENT" | ||
| and $document.dataLicense == "CC0-1.0" | ||
| and ($document.documentNamespace | ||
| | type == "string" and startswith("https://")) | ||
| and ($document.creationInfo.created | ||
| | type == "string" and length > 0) | ||
| and any($document.creationInfo.creators[]?; | ||
| startswith("Tool: syft-")) | ||
| and ($document.packages | type == "array" and length > 0) | ||
| and ($document.relationships | type == "array") |
Comment on lines
+100
to
+112
| jq -e ' | ||
| type == "object" | ||
| and (.spdxVersion | ||
| | type == "string" and test("^SPDX-2\\.[0-9]+$")) | ||
| and .SPDXID == "SPDXRef-DOCUMENT" | ||
| and .dataLicense == "CC0-1.0" | ||
| and (.documentNamespace | ||
| | type == "string" and startswith("https://")) | ||
| and (.creationInfo.created | type == "string" and length > 0) | ||
| and any(.creationInfo.creators[]?; startswith("Tool: syft-")) | ||
| and (.packages | type == "array" and length > 0) | ||
| and (.relationships | type == "array") | ||
| ' "${file}" >/dev/null || fail "invalid SPDX JSON SBOM: ${file}" |
Comment on lines
+118
to
+123
| args: | ||
| - "${artifact}" | ||
| - --output | ||
| - "spdx-json=${document}" | ||
| - --enrich | ||
| - golang |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 19:28
7b08416 to
c3bea33
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 20:32
c3bea33 to
0f85bee
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 20:47
0f85bee to
05a7f6d
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 20:56
05a7f6d to
309aa55
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
2 times, most recently
from
September 10, 2026 21:47
b15f1ce to
7a213bd
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
2 times, most recently
from
September 10, 2026 22:27
85fae29 to
c1bd872
Compare
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 10, 2026 22:46
c1bd872 to
512402b
Compare
Functional Tests - kubernetes-noncloud23 tests 23 ✅ 8m 6s ⏱️ Results for commit 78837b8. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 11, 2026 04:01
512402b to
78837b8
Compare
Generate SPDX JSON SBOMs for every raw rad binary with a pinned, checksum-verified Syft release, and publish them as additive GitHub Release assets without changing the existing binary checksum contract. Enable BuildKit SBOM attestations on every GoReleaser production image and require one valid SPDX document for each locked platform before finalization. Recheck CLI and image SBOMs when reconciling an already published release. Classify the seven CLI SBOM files as intentional parity additions, retain them with GoReleaser workflow metadata, and document how to find both release assets and per-platform image attestations. Refs: #12818 Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/goreleaser-sboms
branch
from
September 11, 2026 04:29
78837b8 to
7992cce
Compare
…on review notes Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Generate SPDX JSON SBOMs for all seven raw
radrelease binaries with checksum-verified Syft v1.51.1, and attach per-platform SPDX SBOM attestations to the five GoReleaser production images.Verify the exact CLI SBOM asset set and document structure on draft and published releases. Verify one image attestation per locked production platform before image locking, finalization, and published-release reconciliation. Existing binary names and checksum assets remain unchanged.
This stacked PR depends on #12828.
Draft gate: keep this PR in draft until one RC draft release contains all seven well-formed CLI SBOM assets and valid attestations for every production-image platform.
Reason for change
PR13 made GoReleaser authoritative for core release artifacts. This additive follow-up uses its native Syft and
dockers_v2integration to expose dependency inventories without creating a parallel publishing path or weakening the existing parity contract.Fixes #12818
How to test
make goreleaser-snapshot GORELEASER_ARGS="--skip=docker"built all 22 targets, generated seven SPDX 2.3 CLI SBOMs, generated no unintended SBOM checksum sidecars, and passed the enhanced output verifier.bash .github/scripts/release-sboms_test.shbash .github/scripts/release-oci-artifacts_test.sh(14 tests, including missing and malformed image attestations)bash .github/scripts/release-parity-manifest_test.shnode --test .github/scripts/release-assets_test.mjs(15 tests)The image-attestation path is covered locally with deterministic Buildx fixtures. A real registry publication remains the draft exit criterion above.
File change summary
.goreleaser.yamlbuild/tools.yaml,build/tools.generated.mk,build/tools.mk,build/scripts/install-syft.sh.github/workflows/{goreleaser-snapshot,build-release}.yaml.github/scripts/{verify-goreleaser-snapshot,release-assets,release-oci-artifacts,release-parity-manifest}*.github/scripts/release-sboms_test.sh,build/test.mkdocs/contributing/contributing-releases/README.mdeng/design-notes/tools/2026-09-goreleaser-stack-review/pr-14-goreleaser-sboms.md