Fix release: stop SBOM action attaching to the GitHub release - #86
Merged
Conversation
anchore/sbom-action defaults to upload-release-assets: true, which attaches the SBOM as a GitHub release asset and needs contents: write. The release-image job is deliberately contents: read (least-privilege). Under the old chart-releaser flow the release was named ballast-<ver>, which never matched the git tag v<ver>, so the action found no release and silently skipped the upload. The OCI-only workflow now creates a release named for the tag (v<ver>), so the action finds it and fails with "Resource not accessible by integration" — which aborted the job before the Attest SBOM and Attest SLSA build provenance steps ran. v0.5.0's image was pushed and signed but shipped WITHOUT its SBOM and provenance attestations as a result. Set upload-release-assets: false; the SBOM is already attested into the OCI referrers store (actions/attest-sbom) and kept as a workflow artifact, so the release asset was redundant. Keeps the job at contents: read.
nickmarden
force-pushed
the
fix/release-sbom-upload-release-assets
branch
from
July 28, 2026 18:56
6bfdaf2 to
67f6f37
Compare
Docker Image Builtdocker pull ghcr.io/tight-line/ballast:pr-86-67f6f37Helm (values override)image:
repository: ghcr.io/tight-line/ballast
tag: "pr-86-67f6f37"Image expires ~15 days after PR closes. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
The first OCI-only release (v0.5.0, running the workstream-F workflow) failed in the
release-imagejob:anchore/sbom-actiondefaults toupload-release-assets: true, which attaches the generated SBOM as a GitHub release asset and needscontents: write. Therelease-imagejob is deliberatelycontents: read(least-privilege, workstream C).Why it only surfaced now
Under the old
chart-releaserflow, the GitHub release was namedballast-<version>, which never matched the git tagv<version>— soanchore/sbom-actionfound no release for the tag and silently skipped the upload. The OCI-only workflow (#85) now creates a release named for the tag (v<version>), so the action finds it and tries to upload, hitting the permission wall.Impact on v0.5.0
The failing step aborted the job before the
Attest SBOMandAttest SLSA build provenancesteps. Verified state of what shipped:ghcr.io/tight-line/ballast:v0.5.0)ghcr.io/tight-line/charts/ballast:0.5.0)So v0.5.0's image is signed but missing the two attestations. A re-release (v0.5.1) is needed once this merges.
The fix
Set
upload-release-assets: falseon the Generate SBOM step. The SBOM is already attested into the OCI referrers store (actions/attest-sbom, verifiable viacosign verify-attestation/gh attestation verify) and kept as a workflow artifact, so the release asset was redundant. This keepsrelease-imageatcontents: readrather than widening it tocontents: writejust to attach a duplicate.Validation
make lint— cleanmake test-coverage-check— passed (no Go changes)release.yml— valid YAMLTag-only workflow, so it can't be exercised on this PR; it gets its first real run on the v0.5.1 re-release after merge.