Skip to content

ci: GitHub Release page and SBOM for every tag #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexeybe1kin merged 1 commit into from
Nov 12, 2026
Merged

ci: GitHub Release page and SBOM for every tag #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
sbom: true

- uses: actions/attest-build-provenance@v4
# Provenance attestation is not available for user-owned private
Expand All @@ -78,3 +79,27 @@ jobs:
subject-name: ${{ env.REGISTRY }}/${{ github.repository }}
subject-digest: ${{ steps.build.outputs.digest }}
push-to-registry: true

release:
# A Release page per tag, its notes the version's CHANGELOG section, so
# "what changed in X.Y.Z" has one answer on GitHub too. Only after the
# images are out: a page for a release nobody can pull is a false claim.
if: startsWith(github.ref, 'refs/tags/v')
needs: [publish]
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v7

- name: Create the Release page from the CHANGELOG section
env:
GH_TOKEN: ${{ github.token }}
run: |
TAG="${GITHUB_REF_NAME#v}"
awk -v head="## ${TAG}" '$0 == head {on = 1; next} /^## / {on = 0} on' CHANGELOG.md > notes.md
if gh release view "$GITHUB_REF_NAME" > /dev/null 2>&1; then
echo "Release ${GITHUB_REF_NAME} already exists; leaving it as it is."
else
gh release create "$GITHUB_REF_NAME" --title "$TAG" --notes-file notes.md --verify-tag
fi
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ replacing a module has to be a decision with visible consequences.

## Unreleased

- **Each tag gets a GitHub Release page and an SBOM.** The Release page's notes are the
version's CHANGELOG section. Every image carries an SPDX SBOM (BuildKit attestation) inside
the image index, and the signed build provenance covers that index digest. Check one with
`gh attestation verify oci://IMAGE@DIGEST --owner Conker-AI`.

## 0.5.2

- **The image takes Debian's zlib security fix** (zlib1g CVE-2026-76844 and CVE-2026-85091,
Expand Down
Loading