Add action for creating release catalog companion

.github/workflows/pr.yml

@@ -20,34 +20,48 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-      - name: Test release build-output materialization
-        run: |
-          ./tests/release_build_output_descriptors_test.sh
-          ./tests/release_build_output_prepare_test.sh
-          ./tests/release_build_output_test.sh
-      - name: Prepare release build-output dispatch smoke test
+
+  test-release-catalog-actions:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Test release catalog materialization
+        run: ./ci/run_release_catalog_tests.sh
+      - name: Prepare release catalog dispatch smoke test
         run: |
-          mkdir -p release-build-output-smoke
-          printf '%s\n' smoke >release-build-output-smoke/package.tar.gz
-      - name: Run release build-output dispatch smoke test
-        uses: ./release-build-output-dispatch
+          mkdir -p release-catalog-smoke
+          printf '%s\n' smoke >release-catalog-smoke/package.tar.gz
+          jq -n \
+            '{ecosystem: "archive", name: "smoke", version: "1.0"}' \
+            >release-catalog-smoke/package-identity.json
+      - name: Run release catalog dispatch smoke test
+        uses: ./release-catalog
         env:
           SHARED_ACTIONS_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           SHARED_ACTIONS_REF: ${{ github.event.pull_request.head.sha }}
         with:
-          artifact-type: custom
-          output-directory: release-build-output-smoke
-          release-artifacts: '[{"path":"package.tar.gz"}]'
-          release-package: '{"ecosystem":"archive","name":"smoke","version":"1.0"}'
-          release-unit: archive:smoke
-          source-artifact-name: release-build-output-dispatch-smoke
+          config: >-
+            {
+              "release_catalog_key": "archive:smoke",
+              "artifact_directory": "release-catalog-smoke",
+              "artifacts": [{
+                "path": "package.tar.gz",
+                "package_identity_file": "package-identity.json"
+              }]
+            }
+          source-artifact-name: release-catalog-smoke
           source-sha: ${{ github.event.pull_request.head.sha }}
-      - name: Verify release build-output dispatch smoke test
+      - name: Verify release catalog dispatch smoke test
         run: |
           jq -e '
-            .artifacts[0].unit_id == "archive:smoke"
-            and .artifacts[0].path == "package.tar.gz"
-          ' release-build-output-smoke/release-build-output.json >/dev/null
-          jq -e '
-            .metadata.artifacts == [{path: "package.tar.gz", sbom_kind: "generated-identity"}]
-          ' release-build-output-smoke/release-build-metadata.json >/dev/null
+            .producer == "rapidsai/shared-actions/release-catalog"
+            and .source.artifact == "release-catalog-smoke"
+            and .entries[0].release_catalog_key == "archive:smoke"
+            and .entries[0].path == "package.tar.gz"
+            and .entries[0].sbom_kind == "generated-identity"
+          ' release-catalog-smoke/release-catalog-entries.json >/dev/null

.pre-commit-config.yaml

@@ -3,14 +3,21 @@
 
 ci:
   autoupdate_schedule: quarterly
-  skip: [actionlint-docker]
+  # These hooks require tools unavailable in pre-commit.ci:
+  #
+  #   * actionlint-docker requires Docker
+  #   * release-catalog-config requires jq
+  #
+  # Both run in other CI jobs with controlled runtime dependencies.
+  skip: [actionlint-docker, release-catalog-config]
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: check-added-large-files
+      - id: check-json
       - id: check-yaml
       - id: end-of-file-fixer
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
@@ -52,3 +59,25 @@ repos:
     hooks:
       - id: yamllint
         additional_dependencies: [pyyaml]
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.2
+    hooks:
+      - id: check-jsonschema
+        name: validate release catalog config schema fixtures
+        args: [--schemafile, release-catalog/config.schema.json]
+        files: ^tests/release-catalog-config/valid/.*\.json$
+  - repo: local
+    hooks:
+      - id: release-catalog-config
+        name: validate release catalog configuration
+        entry: ./tests/release_catalog_config_test.sh
+        language: system
+        pass_filenames: false
+        files: ^(release-catalog/(config\.schema\.json|validate-config\.sh)|tests/release-catalog-config/.*\.json|tests/release_catalog_config_test\.sh)$
+      - id: release-catalog-schemas
+        name: validate release catalog schema contracts
+        entry: python ci/test_release_catalog_schemas.py
+        language: python
+        additional_dependencies: [jsonschema==4.25.1]
+        pass_filenames: false
+        files: ^(release-catalog/(config|entries)\.schema\.json|release-catalog/examples/cuvs-java/release-catalog-entries\.json|tests/release-catalog-config/.*\.json|ci/test_release_catalog_schemas\.py)$

README.md

@@ -9,53 +9,27 @@ A dispatch action is one that:
 * clones the shared-actions repository (repo/ref changeable using env vars)
 * runs (dispatches to) another action within the clone, using a relative path
 
-## Release build-output companions
-
-`release-build-output-dispatch` validates a producer's local build artifact
-directory and uploads a companion artifact named
-`release-build-output-<source-artifact-name>`. The companion contains
-`release-build-output.json`, `release-build-metadata.json`, provenance, and an
-SBOM record for every primary artifact.
-
-Conda and wheel jobs can set `artifact-type` to `conda` or `wheel` and omit
-`release-artifacts`; the implementation reads package metadata from the built
-files. Custom bundles provide explicit artifact descriptors and either inline
-package identity or a producer-created package JSON file.
-
-```yaml
-- name: Create release build-output companion
-  uses: rapidsai/shared-actions/release-build-output-dispatch@main
-  with:
-    artifact-type: wheel
-    output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
-    release-unit: wheel:example
-    source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
-    source-sha: ${{ github.sha }}
-```
-
-A descriptor-selected producer SBOM is classified as `producer-dependency`.
-When no SBOM is supplied, the action generates an SPDX artifact-identity
-envelope and classifies it as `generated-identity`. The generated envelope
-contains the primary artifact's identity and SHA-256 but no dependency
-inventory; it must not be treated as dependency coverage.
-
-The dispatch wrapper honors `SHARED_ACTIONS_REPO` and `SHARED_ACTIONS_REF`.
-When neither is set, it checks out the same repository and ref used to invoke
-the wrapper, which allows a feature-branch wrapper to dispatch to its matching
-implementation during canary testing.
-
-There can be more complicated arrangements of more actions, but the idea is to
-have the local clone of the shared-actions repository be the first step of an action.
-
-Actions that refer to each other assume that they have been checked out to the
-./shared-actions folder. This *should* be the root of the GitHub Actions workspace.
-This assumption is what allow code reuse between actions.
-
-Actions that use this pattern should include "dispatch" in their folder name, so
-that they can be readily distinguished from any actions that are either
-standalone or otherwise implementations that assume that the ./shared-actions
-folder is already cloned, so that they can use relative paths to reference other
-actions and files.
+The checkout is the important part of the pattern. It gives every subsequent
+step a stable `./shared-actions` path and lets a caller test changes by setting
+`SHARED_ACTIONS_REPO` and `SHARED_ACTIONS_REF` without changing the caller's
+`uses:` line. When those variables are absent, dispatch actions normally use
+`rapidsai/shared-actions` at `main`.
+
+The public action and its implementation may use either of two layouts:
+
+* A small dispatch action can invoke a separate implementation action under the
+  checked-out `./shared-actions` directory. This is useful when several public
+  actions share one implementation.
+* A self-dispatching action can keep its `action.yml`, scripts, schemas, and
+  documentation in one folder. After checkout, its shell steps invoke the files
+  in the corresponding `./shared-actions/<action-name>` folder. This is simpler
+  when the implementation has no independent callers.
+
+In both layouts, actions must use files from the checked-out `./shared-actions`
+tree rather than from the revision that initially loaded the public
+`action.yml`. Otherwise `SHARED_ACTIONS_REPO` and `SHARED_ACTIONS_REF` would
+select only the wrapper while the implementation continued to come from a
+different revision.
 
 ## Example dispatch action
 
@@ -72,9 +46,10 @@ runs:
     - name: Clone shared-actions repo
       uses: actions/checkout@v4
       with:
-        repository: ${{ env.SHARED_ACTIONS_REPO }}
-        ref: ${{ env.SHARED_ACTIONS_REF }}
+        repository: ${{ env.SHARED_ACTIONS_REPO || 'rapidsai/shared-actions' }}
+        ref: ${{ env.SHARED_ACTIONS_REF || 'main' }}
         path: ./shared-actions
+        persist-credentials: false
     - name: Run local implementation action
       uses: ./shared-actions/impls/example-action
 ```

ci/run_release_catalog_tests.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+
+set -euo pipefail
+
+repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+"${repository_root}/tests/release_catalog_config_test.sh"
+"${repository_root}/tests/release_catalog_discovery_test.sh"
+"${repository_root}/tests/release_catalog_error_test.sh"
+"${repository_root}/tests/release_catalog_package_parsing_test.sh"
+"${repository_root}/tests/release_catalog_test.sh"

ci/test_release_catalog_schemas.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+
+"""Verify valid and invalid release-catalog contracts against JSON Schema."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from jsonschema import Draft202012Validator
+
+ROOT = Path(__file__).parents[1]
+
+
+def _load(path: Path) -> dict[str, object]:
+    value = json.loads(path.read_text())
+    if not isinstance(value, dict):
+        raise ValueError(f"schema fixture must be a JSON object: {path}")
+    return value
+
+
+def _validator(path: Path) -> Draft202012Validator:
+    schema = _load(path)
+    Draft202012Validator.check_schema(schema)
+    return Draft202012Validator(schema)
+
+
+def main() -> None:
+    config = _validator(ROOT / "release-catalog/config.schema.json")
+    fixtures = ROOT / "tests/release-catalog-config"
+    for path in sorted((fixtures / "valid").glob("*.json")):
+        errors = list(config.iter_errors(_load(path)))
+        if errors:
+            raise ValueError(f"valid fixture rejected: {path}: {errors[0].message}")
+    for path in sorted((fixtures / "invalid").glob("*.json")):
+        if not list(config.iter_errors(_load(path))):
+            raise ValueError(f"invalid fixture accepted: {path}")
+
+    entries = _validator(ROOT / "release-catalog/entries.schema.json")
+    example = _load(ROOT / "release-catalog/examples/cuvs-java/release-catalog-entries.json")
+    errors = list(entries.iter_errors(example))
+    if errors:
+        raise ValueError(f"generated entries example rejected: {errors[0].message}")
+    wrong_producer = {**example, "producer": "some-other-tool"}
+    if not list(entries.iter_errors(wrong_producer)):
+        raise ValueError("entries schema accepted an unknown producer")
+
+
+if __name__ == "__main__":
+    main()