[Kevin Cho (chokevin)]

Summary

Add automatic SPDX 2.3 JSON SBOM generation to coordinated TauGrid releases.

• Generate SBOMs for every published tau and tau-gen platform binary by invoking pinned Syft directly.
• Resolve the published tau, taugrid-portal, and tau-core-controller MCR image indexes with Docker Buildx, then scan both linux/amd64 and linux/arm64 immutable platform manifests directly with Syft.
• Publish 16 component SBOMs plus taugrid-release-sbom-index.json through the existing strict GitHub Release asset flow and include them in SHA256SUMS.
• Keep custom code limited to a focused shell helper that assembles and validates index, SPDX identity, checksum, and exact asset contracts; registry authentication, manifest resolution, and SBOM generation use established Docker and Syft tooling.
• Pin Syft 1.54.1 and verify its published checksum before use.
• Document the release assets and current registry boundary precisely. The existing GitHub release path has read-only public MCR access and no image-publishing/signing identity, so it does not claim or publish OCI referrers.

Release-generated SBOM and index files remain workflow artifacts and are not checked into source control. The release workflow contract checks the required SBOM integration points without maintaining a separate bespoke SBOM test harness.

This change was developed with AI assistance and independently validated and reviewed.

Related issue

Closes #

Validation

Run on macOS in the repository worktree:

bash scripts/ci/tests/release-workflow-contract_test.sh
# Passed: Release workflow contract tests passed

shellcheck scripts/ci/release-sbom-index.sh scripts/ci/tests/release-workflow-contract_test.sh
# Passed

actionlint -ignore 'SC2155' .github/workflows/release-tau.yaml .github/workflows/taugrid-validation.yml
# Passed; SC2155 is an unchanged pre-existing warning in taugrid-validation.yml

python3 scripts/check-license-headers.py
# Passed: License header check passed for 848 source files

git diff --check
# Passed

Additional targeted validation passed:

• Built and validated a synthetic complete release containing 10 CLI SBOMs, six platform image SBOMs, the schema-2.0 index, exact 32-asset allowlist, and SHA256SUMS.
• Verified explicit chart mappings for lifecycleRecorder.image, portal.image, and the controller root image mapping.
• Resolved all three live MCR image indexes and their linux/amd64 and linux/arm64 platform manifests with docker buildx imagetools inspect.
• A real pinned-Syft scan against an immutable MCR platform manifest completed successfully and found 85 packages.

Full draft-release upload/publication is release-context-only and was not run locally. A focused code review found and verified the chart mapping fix; the final rereview reported no significant issues.

Compatibility and operational impact

No runtime, CLI behavior, API, CRD, chart deployment, or configuration behavior changes.

The release workflow now waits for coordinated public MCR image tags, resolves immutable multi-platform digests with Docker Buildx, downloads checksum-verified Syft 1.54.1 from its public upstream release, and publishes additional GitHub Release assets. Fork-based CI validates workflow integration without repository secrets. Live MCR resolution is release-only; OCI attestations/referrers remain outside this workflow because the current image syndication path and registry write identity are external to it.

Checklist

• The change is focused and does not include unrelated edits.
• Tests cover the changed behavior, or I explained why tests are not needed.
• Documentation and examples are updated when public behavior changes.
• Generated files are updated from their source and included in this pull request.
• New dependencies are publicly available and their license and provenance were reviewed.
• The diff contains no secrets, private endpoints, customer data, or Microsoft-internal information.
• Fork-based CI can validate the change without repository secrets, or maintainer-only validation is clearly identified.

[Pengfei Ni (feiskyer)]

LGTM

[Kevin Cho (chokevin)]

Closing to consolidate release publication work around #532.