From 621e87de23348a337d45643b3682b7b3cb00000c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 11 Sep 2026 13:46:58 +0800
Subject: Generate release package changelogs

Attach RPM SBOMs to published image digests and build release notes by
comparing the current and previous SBOM artifacts.
---
 .github/workflows/build.yml            | 45 ++++++++++++++++++++++++++++++++++
 .github/workflows/generate_release.yml | 35 +++++++++++++++++++++++---
 2 files changed, 77 insertions(+), 3 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9a4a95..0b6b8df 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -215,6 +215,30 @@ jobs:
             "${DEFAULT_TAG}" \
             "${ALIAS_TAGS}"
 
+      - name: Install Syft
+        id: setup-syft
+        if: github.event_name != 'pull_request'
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          syft-version: v1.44.0
+
+      - name: Generate RPM SBOM
+        id: generate-sbom
+        if: github.event_name != 'pull_request'
+        env:
+          SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
+        run: |
+          set -euo pipefail
+          sbom="${RUNNER_TEMP}/aerocore-sbom.json"
+          mountpoint="$(sudo podman image mount "${IMAGE_NAME}:${DEFAULT_TAG}")"
+          trap 'sudo podman image unmount "${IMAGE_NAME}:${DEFAULT_TAG}"' EXIT
+          sudo "${SYFT_CMD}" "dir:${mountpoint}" \
+            --select-catalogers rpm \
+            --source-name "${IMAGE_NAME}-${VERSION_TAG}" \
+            -o "syft-json=${sbom}"
+          sudo chown "$(id -u):$(id -g)" "${sbom}"
+          echo "sbom=${sbom}" >> "$GITHUB_OUTPUT"
+
       # These `if` statements keep pull requests from publishing packages.
       # They publish default-branch builds and manual testing branch builds.
       - name: Login to GitHub Container Registry
@@ -241,6 +265,26 @@ jobs:
 
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
+      - name: Install ORAS
+        if: github.event_name != 'pull_request'
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Upload RPM SBOM
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.push-image.outputs.digest }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM: ${{ steps.generate-sbom.outputs.sbom }}
+        run: |
+          set -euo pipefail
+          echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+          cd "$(dirname "${SBOM}")"
+          oras attach \
+            --artifact-type application/vnd.spdx+json \
+            --annotation "filename=$(basename "${SBOM}")" \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}" \
+            "$(basename "${SBOM}")"
+
       # This section is optional and only needs to be enabled if you plan on distributing
       # your project for others to consume. You will need to create a public and private key
       # using Cosign and save the private key as a repository secret in Github for this workflow
@@ -272,6 +316,7 @@ jobs:
          github.ref_name == 'testing-candidate')
     permissions:
       contents: write
+      packages: read
     secrets: inherit
     uses: ./.github/workflows/generate_release.yml
     with:
diff --git a/.github/workflows/generate_release.yml b/.github/workflows/generate_release.yml
index 8ea1f54..3cc432d 100644
--- a/.github/workflows/generate_release.yml
+++ b/.github/workflows/generate_release.yml
@@ -26,12 +26,28 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: write
+      packages: read
 
 
     steps:
       - uses: actions/checkout@v7.0.1
         with:
-          fetch-depth: 50
+          fetch-depth: 0
+
+      - name: Install ORAS
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to GHCR with ORAS
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Align release tag with build commit
         env:
@@ -50,12 +66,25 @@ jobs:
           [[ "${target}" == "main" ]] && target="stable"
           echo "target=${target}" >> "$GITHUB_OUTPUT"
 
+      - name: Generate package and commit changelog
+        env:
+          IMAGE: ghcr.io/${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          HANDWRITTEN: ${{ inputs.handwritten }}
+        run: |
+          python3 .github/scripts/generate_changelog.py \
+            --image "${IMAGE,,}" \
+            --repository "${GITHUB_REPOSITORY}" \
+            --current "${RELEASE_TAG}" \
+            --channel "${{ steps.target.outputs.target }}" \
+            --handwritten "${HANDWRITTEN}" \
+            --output release-notes.md
+
       - name: Generate release
         uses: softprops/action-gh-release@v3.0.2
         with:
           tag_name: "${{ inputs.release_tag }}"
           name: "${{ inputs.release_tag }}"
-          body: |
-            ${{ inputs.handwritten }}
+          body_path: release-notes.md
           prerelease: ${{ steps.target.outputs.target != 'stable' }}
           make_latest: ${{ steps.target.outputs.target == 'stable' }}
-- 
cgit v1.2.3