[Perseus985]

Closes #30

Its the same workflow as in the dependency controller that the release drafter puts the most recent sbon onto the releases.
Thats why I also added the release drafter.

And as a Chore. The CodeOwners file

Summary by CodeRabbit

• New Features
  • Release notes are now drafted automatically, with changes grouped by features, bug fixes, and maintenance when labeled accordingly.
  • Version labels determine whether a release is marked as major, minor, or patch. Pull requests labeled to skip the changelog are excluded.
  • Releases include signed CycloneDX software bills of materials for each supported platform.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a158ddc7-0826-4192-9944-17f99e7ec5a4

📥 Commits

Reviewing files that changed from the base of the PR and between 6a17459 and 7694f5d.

📒 Files selected for processing: 4

• .github/CODEOWNERS
• .github/release-drafter.yml
• .github/workflows/docker.yaml
• .github/workflows/release-drafter.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The PR adds default repository ownership and configures Release Drafter. It updates Docker workflows to build for two Linux platforms, generate per-platform CycloneDX SBOMs, sign them on version-tag pushes, and attach them to draft releases.

Changes: Repository Ownership

Layer / File(s)	Summary
Default repository owner .github/CODEOWNERS	A default ownership rule now assigns all repository paths to @opendefensecloud/cat.

Release Drafter

Layer / File(s)	Summary
Release Drafter configuration and workflow .github/release-drafter.yml, .github/workflows/release-drafter.yaml	The configuration defines release naming, version resolution, label-based categories, and change formatting. A workflow runs the pinned Release Drafter action on pushes to main.

Per-platform SBOM Publishing

Layer / File(s)	Summary
Multi-platform build and SBOM generation .github/workflows/docker.yaml	The workflow sets the two build platforms, enables BuildKit SBOM generation, creates CycloneDX SBOMs for each platform, and uses actions/attest for provenance.
Signed SBOM release assets .github/workflows/docker.yaml	On version-tag pushes, the workflow signs the SBOM files and uploads them as artifacts. A dependent release job downloads the artifacts and attaches them to an existing draft release or creates a draft release with the SBOMs.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant TagPush
  participant DockerWorkflow
  participant Syft
  participant Sigstore
  participant ArtifactStore
  participant ReleaseJob
  participant GitHubRelease
  TagPush->>DockerWorkflow: Trigger version-tag build
  DockerWorkflow->>Syft: Scan image digest for each platform
  Syft-->>DockerWorkflow: Write CycloneDX files
  DockerWorkflow->>Sigstore: Sign each SBOM
  DockerWorkflow->>ArtifactStore: Upload SBOM directory
  TagPush->>ReleaseJob: Trigger release job
  ReleaseJob->>ArtifactStore: Download SBOM artifacts
  ReleaseJob->>GitHubRelease: Attach assets or create draft release

Loading

Suggested reviewers: bergcyrill

Merge Risk: ⚪ Minimal · up to 7694f

This change adds release automation and signed per-platform SBOM release assets. No concrete merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #30 requires eight release assets, valid Sigstore bundles, and a passing zizmor check. The workflow statically generates the eight required filenames: two images multiplied by linux/amd64 an…	Provide reviewable CI or release evidence for one tag that contains all eight assets, successful cosign verify-blob --bundle results for all four SBOMs, and a passing zizmor run for the changed workflows.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: ensuring SBOM release artifacts. It is concise and related to the workflow and release-drafter updates.
Out of Scope Changes check		The release-drafter workflow and configuration support release creation and release asset publication for issue #30. The .github/CODEOWNERS change is the explicitly described repository-maintenance …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Out of Scope Changes check

Explanation

The release-drafter workflow and configuration support release creation and release asset publication for issue #30. The .github/CODEOWNERS change is the explicitly described repository-maintenance chore. No unrelated change is shown in the reviewed summary.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Full details: Linked Issues check

Explanation

Issue #30 requires eight release assets, valid Sigstore bundles, and a passing zizmor check. The workflow statically generates the eight required filenames: two images multiplied by linux/amd64 and linux/arm64. It signs each CycloneDX file with cosign sign-blob --bundle and uploads all files to a draft release. The repository evidence does not establish that a new release contains all eight assets, that each bundle verifies, or that zizmor passes.

Resolution

Provide reviewable CI or release evidence for one tag that contains all eight assets, successful cosign verify-blob --bundle results for all four SBOMs, and a passing zizmor run for the changed workflows.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ducke]

See no evil :)