From f46c2dbbfc9325f88b65441e97befcb248b77434 Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Thu, 29 Oct 2026 19:21:04 +0100 Subject: [PATCH] ci(release): publish the release after the SBOM uploads goreleaser creates the release as a draft. The release workflow uploads the SBOMs and then publishes the release. This lets the repository use GitHub immutable releases, which reject new assets after publication. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 6ef5e9f5-dc0c-45cf-8b3f-70d112a87b7e --- .github/workflows/release.yaml | 8 ++++++++ .goreleaser.yml | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 25a21b16c..18fcbe189 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -214,6 +214,14 @@ jobs: chainloop attestation add --name $material_name --value $entry --kind ARTIFACT --attestation-id ${{ env.ATTESTATION_ID }} done + - name: Publish release + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + # goreleaser creates the release as a draft. Publish it after all + # assets are uploaded: an immutable release cannot get new assets. + gh release edit "$RELEASE_TAG" --draft=false --latest + - name: Include source code on attestation env: ATTESTATION_ID: ${{ steps.init_attestation.outputs.attestation_id }} diff --git a/.goreleaser.yml b/.goreleaser.yml index 807e30d5b..2dac9046b 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -246,5 +246,9 @@ docker_manifests: - "ghcr.io/chainloop-dev/chainloop/cli:{{ .Tag }}-arm64" release: + # The release workflow uploads the SBOMs after goreleaser and then publishes + # the release, so the release does not change after it is published. + draft: true + replace_existing_draft: true extra_files: - glob: ./.github/workflows/cosign.pub