feat(changelogs): Use SBOMs for standardized package data extraction - #4635
Conversation
dosubot
Bot
added
size:L
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Complexity | 1 medium |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
There was a problem hiding this comment.
Pull request overview
Refactors the release changelog generator to derive package/version changes from container image SBOMs stored as OCI referrers, instead of relying on custom image labels.
Changes:
- Update
.github/changelogs.pyto fetch image digests withskopeo, discover/pull SBOMs viaoras, and parse RPM package data from the SBOM. - Adjust the release workflow to install ORAS and scope default workflow permissions to empty (job-level
contents: write). - Add a
gen-sbomutility recipe and ignore its local output directory (sbom_out/).
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
Justfile |
Adds a gen-sbom utility recipe to export an image rootfs and generate a Syft SBOM. |
.gitignore |
Ignores sbom_out/ artifacts produced by local SBOM generation. |
.github/workflows/generate-release.yml |
Installs ORAS for SBOM retrieval and tightens default permissions. |
.github/renovate.json5 |
Removes the legacy rechunk image from a non-automerge rule. |
.github/changelogs.py |
Switches package extraction to SBOM referrers discovered/pulled with ORAS. |
Comments suppressed due to low confidence (1)
.github/workflows/generate-release.yml:56
changelogs.pynow usesoras discover/pullagainst GHCR, but this workflow only installs ORAS and does not authenticate toghcr.io. This can fail in practice (e.g., SBOM referrers access requiring auth / rate limits). Add anoras login ghcr.iostep (usingGITHUB_TOKEN) and ensure the job haspackages: readpermission if needed.
- name: Install ORAS
uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
- name: Generate Release Text
id: generate-release-text
shell: bash
run: |
just changelogs "${{ matrix.version }}" "${{ inputs.handwritten }}"
source ./output.env
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
renner0e
left a comment
renner0e
left a comment
There was a problem hiding this comment.
you are introducing the justfile recipe here for generating the SBOMs, but not using it
Refactors the changelog generation script to fetch package information from image Software Bill of Materials (SBOMs) instead of custom labels. This is split out of ublue-os#4564 to derisk the change
37bc248 to
fe8e7f0
Compare
Ah, good catch. I saw the new SBOM flow was working via the changelog script, but I've updated it in the reusable build too |
|
https://github.com/dylanmtaylor/bluefin/actions/runs/25951141071/job/76289092973 worked correctly and exercised the SBOM logic - tested there since PRs don't try it. |
renner0e
left a comment
renner0e
left a comment
There was a problem hiding this comment.
I have not tested this in any capacity but the approach chosen here has worked for aurora...
Refactors the changelog generation script to fetch package information from image Software Bill of Materials (SBOMs) instead of custom labels.
This is split out of #4564 to derisk the change