From f19cf9f7eb8a945478ef89b15cae06e6d69d51d9 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 4 Aug 2026 09:50:04 -0500 Subject: [PATCH 01/14] feat: add release build output manifests Created with Codex (GPT-5). --- .github/workflows/conda-cpp-build.yaml | 15 ++++++ .github/workflows/conda-python-build.yaml | 15 ++++++ .github/workflows/custom-job.yaml | 42 ++++++++++++++++ .github/workflows/wheels-build.yaml | 15 ++++++ README.md | 61 +++++++++++++++++++++++ 5 files changed, 148 insertions(+) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 4f8a4461..b611deab 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -44,6 +44,11 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-unit: + type: string + default: '' + required: false + description: "Override the release-platform unit ID; defaults to conda:" matrix_filter: description: | jq expression which modifies the matrix. @@ -226,6 +231,16 @@ jobs: if-no-files-found: 'error' name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + + - name: Create Conda release build-output companion + if: ${{ inputs.upload-artifacts }} + uses: rapidsai/shared-actions/release-build-output-dispatch@main + with: + artifact-type: conda + output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit || format('conda:{0}', github.event.repository.name) }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)" diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 1a2bb291..1d5a6cc7 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -44,6 +44,11 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-unit: + type: string + default: '' + required: false + description: "Override the release-platform unit ID; defaults to conda:" matrix_filter: description: | jq expression which modifies the matrix. @@ -231,6 +236,16 @@ jobs: if-no-files-found: 'error' name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + + - name: Create Conda release build-output companion + if: ${{ inputs.upload-artifacts }} + uses: rapidsai/shared-actions/release-build-output-dispatch@main + with: + artifact-type: conda + output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit || format('conda:{0}', github.event.repository.name) }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 7bc2560e..462270bc 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -105,6 +105,36 @@ on: default: false type: boolean required: false + release-build-output: + description: "Generate a release-build-output companion for the uploaded artifact bundle" + default: false + type: boolean + required: false + release-unit: + description: "Stable release-platform unit ID; required when release-build-output is true" + default: '' + type: string + required: false + release-package: + description: "JSON package identity shared by the bundle; mutually exclusive with release-package-file" + default: '' + type: string + required: false + release-package-file: + description: "Producer-created package JSON relative to release-output-directory" + default: '' + type: string + required: false + release-artifacts: + description: "JSON primary-artifact and evidence descriptors relative to release-output-directory" + default: '' + type: string + required: false + release-output-directory: + description: "Directory containing the primary artifact paths described by release-artifacts" + default: '.' + type: string + required: false defaults: run: @@ -228,6 +258,18 @@ jobs: name: ${{ inputs.artifact-name }} path: ${{ inputs.file_to_upload }} if-no-files-found: ignore + - name: Create release build-output companion + if: ${{ inputs.release-build-output }} + uses: rapidsai/shared-actions/release-build-output-dispatch@main + with: + artifact-type: custom + output-directory: ${{ inputs.release-output-directory }} + release-artifacts: ${{ inputs.release-artifacts }} + release-package: ${{ inputs.release-package }} + release-package-file: ${{ inputs.release-package-file }} + release-unit: ${{ inputs.release-unit }} + source-artifact-name: ${{ inputs.artifact-name }} + source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "custom-job-$(arch)" diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index c4050159..b27fea49 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -75,6 +75,11 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" + release-unit: + type: string + default: '' + required: false + description: "Override the release-platform unit ID; defaults to wheel:" extra-repo: required: false type: string @@ -298,6 +303,16 @@ jobs: name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} + - name: Create wheel release build-output companion + if: ${{ inputs.upload-artifacts }} + uses: rapidsai/shared-actions/release-build-output-dispatch@main + with: + artifact-type: wheel + output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} + release-unit: ${{ inputs.release-unit || format('wheel:{0}', github.event.repository.name) }} + source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} + source-sha: ${{ inputs.sha || github.sha }} + - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/README.md b/README.md index 9752c524..9e9cacf3 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,67 @@ Reusable workflows must be placed in the `.github/workflows` directory as mentio ## Usage +### release-build-output + +Release build-output companions are created inside the producer job by the +[`release-build-output-dispatch`](https://github.com/rapidsai/shared-actions/tree/main/release-build-output-dispatch) +shared action. Running beside the build keeps the producer's matrix, +source-artifact name, and original files authoritative and avoids a second +runner and artifact download. + +The standard wheel and Conda builders create a companion for every uploaded +bundle. The release unit defaults to `wheel:` or +`conda:` and can be overridden with `release-unit` when the +release-platform catalog uses a different ID. The shared action reads exact +package metadata from the built files and uploads +`release-build-output-`. No release-specific caller +configuration is required for the standard builders. + +`custom-job.yaml` remains explicitly opt-in through `release-build-output` and +also requires `release-unit`, `release-output-directory`, `release-artifacts`, +and either `release-package` or +`release-package-file`. Descriptors may name producer-supplied SBOM, +provenance, and signature sidecars relative to the output directory. Each path +or glob must resolve to exactly one file; the action never guesses a release +artifact. + +```yaml +cuvs-java-build: + uses: rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main + with: + # existing build inputs omitted + artifact-name: cuvs-java-cuda12.9.1 + file_to_upload: java/cuvs-java/target/ + release-build-output: true + release-output-directory: java/cuvs-java/target + release-unit: maven:cuvs-java + release-package-file: cuvs-java.release-package.json + release-artifacts: '[{"path":"cuvs-java-*-x86_64-cuda*.jar"}]' +``` + +The release coordinator downloads both artifacts into the same directory, for +example `release-build-outputs/cuvs-java/cuda12.9.1/`. The resulting tree has +one `release-build-output.json` per producer job and is consumed directly by +`rapids-release shadow file`. It does not require Artifactory. + +The companion artifact also carries `release-build-metadata.json`. It records +the artifact identity, manifest filename, GitHub build identity, and one +`metadata.artifacts` entry per primary artifact. Each entry explicitly sets +`sbom_kind` to `producer-dependency` or `generated-identity`. SBOM and +provenance paths remain authoritative in `release-build-output.json`; supplied +sidecars are copied under `release-evidence/` so the companion is independently +self-contained. + +When no SBOM is selected, the action generates an SPDX artifact-identity +envelope containing package identity and the primary artifact SHA-256. It is +classified as `generated-identity`, contains no dependency inventory, and must +not be reported as a producer-supplied dependency SBOM. A descriptor-selected +producer SBOM is instead classified as `producer-dependency`. + +The cross-repository enrollment inventory, blockers, and proposed PR sequence +are maintained in +[`rapidsai/build-infra#381`](https://github.com/rapidsai/build-infra/issues/381). + ### matrix_filter Several of the workflows in this project have matrices (combinations of workflow inputs) expressed in inline YAML/JSON. From 31a99e1aaf9c087b10eaed77f5446cbe6eef12e5 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Fri, 7 Aug 2026 13:43:04 -0500 Subject: [PATCH 02/14] Test container-safe release output dispatch --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/custom-job.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index b611deab..0fda73ad 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -234,7 +234,7 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@main + uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container with: artifact-type: conda output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 1d5a6cc7..4d6a577d 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -239,7 +239,7 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@main + uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container with: artifact-type: conda output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 462270bc..92c2a2f0 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -260,7 +260,7 @@ jobs: if-no-files-found: ignore - name: Create release build-output companion if: ${{ inputs.release-build-output }} - uses: rapidsai/shared-actions/release-build-output-dispatch@main + uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container with: artifact-type: custom output-directory: ${{ inputs.release-output-directory }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index b27fea49..c948f176 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -305,7 +305,7 @@ jobs: - name: Create wheel release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@main + uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container with: artifact-type: wheel output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} From b548f50d3ff81e1b4cc0d981725d98f8b37b3ec1 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Fri, 7 Aug 2026 13:47:29 -0500 Subject: [PATCH 03/14] Use RAPIDS-owned dispatch canary ref --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/custom-job.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 0fda73ad..4e6a1553 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -234,7 +234,7 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container with: artifact-type: conda output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 4d6a577d..86639ffa 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -239,7 +239,7 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container with: artifact-type: conda output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 92c2a2f0..21378010 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -260,7 +260,7 @@ jobs: if-no-files-found: ignore - name: Create release build-output companion if: ${{ inputs.release-build-output }} - uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container with: artifact-type: custom output-directory: ${{ inputs.release-output-directory }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index c948f176..5d105b8c 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -305,7 +305,7 @@ jobs: - name: Create wheel release build-output companion if: ${{ inputs.upload-artifacts }} - uses: msarahan/shared-actions/release-build-output-dispatch@76acdd577825aefd04d8ea143449101b707acee6 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container with: artifact-type: wheel output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} From 178d21ccb5024ef8214cdebe4c5f3a3ba1a14d9c Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Thu, 13 Aug 2026 09:52:35 -0500 Subject: [PATCH 04/14] Clarify release output inputs --- .github/workflows/conda-cpp-build.yaml | 16 ++++--- .github/workflows/conda-python-build.yaml | 16 ++++--- .github/workflows/custom-job.yaml | 42 ++++--------------- .github/workflows/wheels-build.yaml | 16 ++++--- README.md | 51 ++++++++++++++++------- 5 files changed, 77 insertions(+), 64 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 4e6a1553..aea05a95 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -48,7 +48,10 @@ on: type: string default: '' required: false - description: "Override the release-platform unit ID; defaults to conda:" + description: >- + Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups + files and matrix variants for release assembly. Leave empty to use conda:; override only + when one repository's Conda producers must be tracked as distinct components. matrix_filter: description: | jq expression which modifies the matrix. @@ -234,11 +237,14 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - artifact-type: conda - output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} - release-unit: ${{ inputs.release-unit || format('conda:{0}', github.event.repository.name) }} + config: >- + { + "artifact_type": "conda", + "component_id": ${{ toJSON(inputs.release-unit || format('conda:{0}', github.event.repository.name)) }}, + "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} + } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 86639ffa..2d0207de 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -48,7 +48,10 @@ on: type: string default: '' required: false - description: "Override the release-platform unit ID; defaults to conda:" + description: >- + Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups + files and matrix variants for release assembly. Leave empty to use conda:; override only + when one repository's Conda producers must be tracked as distinct components. matrix_filter: description: | jq expression which modifies the matrix. @@ -239,11 +242,14 @@ jobs: - name: Create Conda release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - artifact-type: conda - output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} - release-unit: ${{ inputs.release-unit || format('conda:{0}', github.event.repository.name) }} + config: >- + { + "artifact_type": "conda", + "component_id": ${{ toJSON(inputs.release-unit || format('conda:{0}', github.event.repository.name)) }}, + "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} + } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 21378010..bc2f1739 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -106,35 +106,14 @@ on: type: boolean required: false release-build-output: - description: "Generate a release-build-output companion for the uploaded artifact bundle" - default: false - type: boolean - required: false - release-unit: - description: "Stable release-platform unit ID; required when release-build-output is true" - default: '' - type: string - required: false - release-package: - description: "JSON package identity shared by the bundle; mutually exclusive with release-package-file" - default: '' - type: string - required: false - release-package-file: - description: "Producer-created package JSON relative to release-output-directory" + description: >- + Optional JSON object describing a custom release package bundle. A non-empty value creates the companion; + leave empty for logs, documentation, tests, and other non-release artifacts. Requires artifact_type set to + custom, component_id, artifacts, and exactly one of package or package_file; output_directory defaults to + '.'. The shared action validates every field before inspecting build outputs. default: '' type: string required: false - release-artifacts: - description: "JSON primary-artifact and evidence descriptors relative to release-output-directory" - default: '' - type: string - required: false - release-output-directory: - description: "Directory containing the primary artifact paths described by release-artifacts" - default: '.' - type: string - required: false defaults: run: @@ -259,15 +238,10 @@ jobs: path: ${{ inputs.file_to_upload }} if-no-files-found: ignore - name: Create release build-output companion - if: ${{ inputs.release-build-output }} - uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container + if: ${{ inputs.release-build-output != '' }} + uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - artifact-type: custom - output-directory: ${{ inputs.release-output-directory }} - release-artifacts: ${{ inputs.release-artifacts }} - release-package: ${{ inputs.release-package }} - release-package-file: ${{ inputs.release-package-file }} - release-unit: ${{ inputs.release-unit }} + config: ${{ inputs.release-build-output }} source-artifact-name: ${{ inputs.artifact-name }} source-sha: ${{ inputs.sha || github.sha }} - name: Upload additional artifacts diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 5d105b8c..38808dda 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -79,7 +79,10 @@ on: type: string default: '' required: false - description: "Override the release-platform unit ID; defaults to wheel:" + description: >- + Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups + files and matrix variants for release assembly. Leave empty to use wheel:; override only + when one repository's wheel producers must be tracked as distinct components. extra-repo: required: false type: string @@ -305,11 +308,14 @@ jobs: - name: Create wheel release build-output companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@3a9568fc2c9bc9fd05e4cf76a73d9ad481f93ac5 # agent/release-build-output-container + uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - artifact-type: wheel - output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} - release-unit: ${{ inputs.release-unit || format('wheel:{0}', github.event.repository.name) }} + config: >- + { + "artifact_type": "wheel", + "component_id": ${{ toJSON(inputs.release-unit || format('wheel:{0}', github.event.repository.name)) }}, + "output_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} + } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ inputs.sha || github.sha }} diff --git a/README.md b/README.md index 9e9cacf3..6cce6616 100644 --- a/README.md +++ b/README.md @@ -29,20 +29,38 @@ source-artifact name, and original files authoritative and avoids a second runner and artifact download. The standard wheel and Conda builders create a companion for every uploaded -bundle. The release unit defaults to `wheel:` or +bundle. The release component ID defaults to `wheel:` or `conda:` and can be overridden with `release-unit` when the -release-platform catalog uses a different ID. The shared action reads exact -package metadata from the built files and uploads +release catalog needs to track multiple producer families in one repository as +distinct components. `release-unit` is the API's historical name for this ID. +It is a string label, not a file, directory, artifact bundle, or list of files. +The same ID is written on every primary file in the component and is reused +across its matrix variants, such as CUDA version, Python version, and +architecture, so release assembly can group those outputs together. Most +standard Conda and wheel callers should leave `release-unit` unset. The shared +action reads exact package metadata from the built files and uploads `release-build-output-`. No release-specific caller configuration is required for the standard builders. -`custom-job.yaml` remains explicitly opt-in through `release-build-output` and -also requires `release-unit`, `release-output-directory`, `release-artifacts`, -and either `release-package` or -`release-package-file`. Descriptors may name producer-supplied SBOM, -provenance, and signature sidecars relative to the output directory. Each path -or glob must resolve to exactly one file; the action never guesses a release -artifact. +`custom-job.yaml` remains explicitly opt-in through one `release-build-output` +JSON object. An empty string disables companion generation. A non-empty object +requires `artifact_type: custom`, `component_id`, a non-empty `artifacts` +array, and exactly one of `package` or `package_file`; `output_directory` +defaults to the job's working directory. Descriptors may name +producer-supplied SBOM, provenance, and +signature sidecars relative to the output directory. Each path or glob must +resolve to exactly one file; the action never guesses a release artifact. + +| Custom-job input | Why and when to use it | +| --- | --- | +| `release-build-output` | Supply one complete JSON configuration only when the upload is a release package bundle. Its presence enables companion generation; an empty value disables it. The shared action reports malformed JSON, unknown keys, missing fields, conflicting package sources, and invalid artifact descriptors before materialization. | + +The canonical schema is +[`release-build-output/config.schema.json`](https://github.com/rapidsai/shared-actions/blob/a18a4a7ac572366c09c15641ec274cc6f15bfb5d/release-build-output/config.schema.json). +Pre-commit exercises the schema validator against valid and invalid fixtures. +The pipeline additionally checks properties that cannot be known before the +build, including whether package files and artifact/evidence globs resolve to +exactly one file. ```yaml cuvs-java-build: @@ -51,11 +69,14 @@ cuvs-java-build: # existing build inputs omitted artifact-name: cuvs-java-cuda12.9.1 file_to_upload: java/cuvs-java/target/ - release-build-output: true - release-output-directory: java/cuvs-java/target - release-unit: maven:cuvs-java - release-package-file: cuvs-java.release-package.json - release-artifacts: '[{"path":"cuvs-java-*-x86_64-cuda*.jar"}]' + release-build-output: >- + { + "artifact_type": "custom", + "component_id": "maven:cuvs-java", + "output_directory": "java/cuvs-java/target", + "package_file": "cuvs-java.release-package.json", + "artifacts": [{"path": "cuvs-java-*-x86_64-cuda*.jar"}] + } ``` The release coordinator downloads both artifacts into the same directory, for From 9008e17758106abfe4ad85fd80df2460aeecabb2 Mon Sep 17 00:00:00 2001 From: Mike Sarahan Date: Mon, 17 Aug 2026 20:09:33 -0500 Subject: [PATCH 05/14] improve description and parameter name of release-build-output param Co-authored-by: James Lamb --- .github/workflows/custom-job.yaml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index bc2f1739..fd750540 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -105,12 +105,9 @@ on: default: false type: boolean required: false - release-build-output: + release-build-config: description: >- - Optional JSON object describing a custom release package bundle. A non-empty value creates the companion; - leave empty for logs, documentation, tests, and other non-release artifacts. Requires artifact_type set to - custom, component_id, artifacts, and exactly one of package or package_file; output_directory defaults to - '.'. The shared action validates every field before inspecting build outputs. + Optional JSON string with additional configuration for the `shared-actions/release-build-output-dispatch` action. See https://github.com/rapidsai/shared-actions/tree/main/release-build-output for details. If non-empty, creates a release manifest for artifacts produced by this job. default: '' type: string required: false From b5ed206f0b025a629690c3816bcde5bd743471b5 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Mon, 17 Aug 2026 20:22:44 -0500 Subject: [PATCH 06/14] Address release build output review feedback --- .github/workflows/conda-cpp-build.yaml | 12 +-- .github/workflows/conda-python-build.yaml | 12 +-- .github/workflows/custom-job.yaml | 10 ++- .github/workflows/wheels-build.yaml | 12 +-- README.md | 97 ++++------------------- 5 files changed, 28 insertions(+), 115 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index aea05a95..d817ef9d 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -44,14 +44,6 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" - release-unit: - type: string - default: '' - required: false - description: >- - Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups - files and matrix variants for release assembly. Leave empty to use conda:; override only - when one repository's Conda producers must be tracked as distinct components. matrix_filter: description: | jq expression which modifies the matrix. @@ -242,11 +234,11 @@ jobs: config: >- { "artifact_type": "conda", - "component_id": ${{ toJSON(inputs.release-unit || format('conda:{0}', github.event.repository.name)) }}, + "component_id": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ inputs.sha || github.sha }} + source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)" diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 2d0207de..6b9e7c98 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -44,14 +44,6 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" - release-unit: - type: string - default: '' - required: false - description: >- - Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups - files and matrix variants for release assembly. Leave empty to use conda:; override only - when one repository's Conda producers must be tracked as distinct components. matrix_filter: description: | jq expression which modifies the matrix. @@ -247,11 +239,11 @@ jobs: config: >- { "artifact_type": "conda", - "component_id": ${{ toJSON(inputs.release-unit || format('conda:{0}', github.event.repository.name)) }}, + "component_id": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ inputs.sha || github.sha }} + source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index fd750540..2b1504f3 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -107,7 +107,9 @@ on: required: false release-build-config: description: >- - Optional JSON string with additional configuration for the `shared-actions/release-build-output-dispatch` action. See https://github.com/rapidsai/shared-actions/tree/main/release-build-output for details. If non-empty, creates a release manifest for artifacts produced by this job. + Optional JSON configuration for the `shared-actions/release-build-output-dispatch` action. When non-empty, + this job uploads an additional `release-build-output-` GitHub Actions artifact. See + https://github.com/rapidsai/shared-actions/tree/main/release-build-output for configuration details. default: '' type: string required: false @@ -235,12 +237,12 @@ jobs: path: ${{ inputs.file_to_upload }} if-no-files-found: ignore - name: Create release build-output companion - if: ${{ inputs.release-build-output != '' }} + if: ${{ inputs.release-build-config != '' }} uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - config: ${{ inputs.release-build-output }} + config: ${{ inputs.release-build-config }} source-artifact-name: ${{ inputs.artifact-name }} - source-sha: ${{ inputs.sha || github.sha }} + source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "custom-job-$(arch)" diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 38808dda..268c344c 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -75,14 +75,6 @@ on: default: true required: false description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store" - release-unit: - type: string - default: '' - required: false - description: >- - Release component ID: a string label, not a file or bundle. It is written to each manifest entry and groups - files and matrix variants for release assembly. Leave empty to use wheel:; override only - when one repository's wheel producers must be tracked as distinct components. extra-repo: required: false type: string @@ -313,11 +305,11 @@ jobs: config: >- { "artifact_type": "wheel", - "component_id": ${{ toJSON(inputs.release-unit || format('wheel:{0}', github.event.repository.name)) }}, + "component_id": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ inputs.sha || github.sha }} + source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" diff --git a/README.md b/README.md index 6cce6616..0be1bd83 100644 --- a/README.md +++ b/README.md @@ -20,87 +20,22 @@ Reusable workflows must be placed in the `.github/workflows` directory as mentio ## Usage -### release-build-output - -Release build-output companions are created inside the producer job by the -[`release-build-output-dispatch`](https://github.com/rapidsai/shared-actions/tree/main/release-build-output-dispatch) -shared action. Running beside the build keeps the producer's matrix, -source-artifact name, and original files authoritative and avoids a second -runner and artifact download. - -The standard wheel and Conda builders create a companion for every uploaded -bundle. The release component ID defaults to `wheel:` or -`conda:` and can be overridden with `release-unit` when the -release catalog needs to track multiple producer families in one repository as -distinct components. `release-unit` is the API's historical name for this ID. -It is a string label, not a file, directory, artifact bundle, or list of files. -The same ID is written on every primary file in the component and is reused -across its matrix variants, such as CUDA version, Python version, and -architecture, so release assembly can group those outputs together. Most -standard Conda and wheel callers should leave `release-unit` unset. The shared -action reads exact package metadata from the built files and uploads -`release-build-output-`. No release-specific caller -configuration is required for the standard builders. - -`custom-job.yaml` remains explicitly opt-in through one `release-build-output` -JSON object. An empty string disables companion generation. A non-empty object -requires `artifact_type: custom`, `component_id`, a non-empty `artifacts` -array, and exactly one of `package` or `package_file`; `output_directory` -defaults to the job's working directory. Descriptors may name -producer-supplied SBOM, provenance, and -signature sidecars relative to the output directory. Each path or glob must -resolve to exactly one file; the action never guesses a release artifact. - -| Custom-job input | Why and when to use it | -| --- | --- | -| `release-build-output` | Supply one complete JSON configuration only when the upload is a release package bundle. Its presence enables companion generation; an empty value disables it. The shared action reports malformed JSON, unknown keys, missing fields, conflicting package sources, and invalid artifact descriptors before materialization. | - -The canonical schema is -[`release-build-output/config.schema.json`](https://github.com/rapidsai/shared-actions/blob/a18a4a7ac572366c09c15641ec274cc6f15bfb5d/release-build-output/config.schema.json). -Pre-commit exercises the schema validator against valid and invalid fixtures. -The pipeline additionally checks properties that cannot be known before the -build, including whether package files and artifact/evidence globs resolve to -exactly one file. - -```yaml -cuvs-java-build: - uses: rapidsai/shared-workflows/.github/workflows/custom-job.yaml@main - with: - # existing build inputs omitted - artifact-name: cuvs-java-cuda12.9.1 - file_to_upload: java/cuvs-java/target/ - release-build-output: >- - { - "artifact_type": "custom", - "component_id": "maven:cuvs-java", - "output_directory": "java/cuvs-java/target", - "package_file": "cuvs-java.release-package.json", - "artifacts": [{"path": "cuvs-java-*-x86_64-cuda*.jar"}] - } -``` - -The release coordinator downloads both artifacts into the same directory, for -example `release-build-outputs/cuvs-java/cuda12.9.1/`. The resulting tree has -one `release-build-output.json` per producer job and is consumed directly by -`rapids-release shadow file`. It does not require Artifactory. - -The companion artifact also carries `release-build-metadata.json`. It records -the artifact identity, manifest filename, GitHub build identity, and one -`metadata.artifacts` entry per primary artifact. Each entry explicitly sets -`sbom_kind` to `producer-dependency` or `generated-identity`. SBOM and -provenance paths remain authoritative in `release-build-output.json`; supplied -sidecars are copied under `release-evidence/` so the companion is independently -self-contained. - -When no SBOM is selected, the action generates an SPDX artifact-identity -envelope containing package identity and the primary artifact SHA-256. It is -classified as `generated-identity`, contains no dependency inventory, and must -not be reported as a producer-supplied dependency SBOM. A descriptor-selected -producer SBOM is instead classified as `producer-dependency`. - -The cross-repository enrollment inventory, blockers, and proposed PR sequence -are maintained in -[`rapidsai/build-infra#381`](https://github.com/rapidsai/build-infra/issues/381). +### Release build outputs + +The standard Conda and wheel builders upload an additional +`release-build-output-` GitHub Actions artifact for every package +bundle. It contains build metadata and the available provenance and SBOM +evidence used during release assembly. + +`custom-job.yaml` is opt-in. Supplying a non-empty `release-build-config` causes +the job to upload the additional release-build-output artifact; leaving it empty +uploads only the original artifact. + +See the +[`shared-actions` release-build-output documentation](https://github.com/rapidsai/shared-actions/tree/main/release-build-output) +for the companion layout, configuration schema, examples, and evidence +semantics. A generated identity-only SPDX record identifies and hashes an +artifact, but does not provide dependency or source-license coverage. ### matrix_filter From 98762b30804419c5e22d9ae6f746163030cbf271 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Mon, 17 Aug 2026 20:43:57 -0500 Subject: [PATCH 07/14] simplify release-build-output section --- README.md | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 0be1bd83..cd01713e 100644 --- a/README.md +++ b/README.md @@ -20,23 +20,6 @@ Reusable workflows must be placed in the `.github/workflows` directory as mentio ## Usage -### Release build outputs - -The standard Conda and wheel builders upload an additional -`release-build-output-` GitHub Actions artifact for every package -bundle. It contains build metadata and the available provenance and SBOM -evidence used during release assembly. - -`custom-job.yaml` is opt-in. Supplying a non-empty `release-build-config` causes -the job to upload the additional release-build-output artifact; leaving it empty -uploads only the original artifact. - -See the -[`shared-actions` release-build-output documentation](https://github.com/rapidsai/shared-actions/tree/main/release-build-output) -for the companion layout, configuration schema, examples, and evidence -semantics. A generated identity-only SPDX record identifies and hashes an -artifact, but does not provide dependency or source-license coverage. - ### matrix_filter Several of the workflows in this project have matrices (combinations of workflow inputs) expressed in inline YAML/JSON. @@ -113,3 +96,23 @@ wheel-tests: ``` Values passed through `secrets:` are redacted everywhere in the GitHub UI, including in logs, and in most cases are replaced with `***`. + +### Release build outputs + +We add additional metadata files to our builds to help track what dependencies +were present at build time (a Software Bill of Materials, SBoM), as well as +keeping track of artifacts as we prepare for releases. The standard Conda and +wheel builders do this automatically and upload an additional +`release-build-output-` GitHub Actions artifact for every package +bundle. + +`custom-job.yaml` can be used to produce artifacts, but the generation of extra +metadata files are opt-in, not automatic. Supplying a non-empty +`release-build-config` causes the job to upload the additional +release-build-output artifact; leaving it empty uploads only the original +artifact. + +See the +[`shared-actions` release-build-output documentation](https://github.com/rapidsai/shared-actions/tree/main/release-build-output) +for the companion layout, configuration schema, examples, and evidence +semantics. From dcb7583757abd017cd33924193b6926bcb26677c Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Mon, 17 Aug 2026 21:20:28 -0500 Subject: [PATCH 08/14] Use release catalog configuration terminology --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/custom-job.yaml | 6 +++--- .github/workflows/wheels-build.yaml | 2 +- README.md | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index d817ef9d..3fbfd756 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -234,7 +234,7 @@ jobs: config: >- { "artifact_type": "conda", - "component_id": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, + "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 6b9e7c98..7416c23a 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -239,7 +239,7 @@ jobs: config: >- { "artifact_type": "conda", - "component_id": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, + "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 2b1504f3..6555aa0b 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -105,7 +105,7 @@ on: default: false type: boolean required: false - release-build-config: + release-catalog-config: description: >- Optional JSON configuration for the `shared-actions/release-build-output-dispatch` action. When non-empty, this job uploads an additional `release-build-output-` GitHub Actions artifact. See @@ -237,10 +237,10 @@ jobs: path: ${{ inputs.file_to_upload }} if-no-files-found: ignore - name: Create release build-output companion - if: ${{ inputs.release-build-config != '' }} + if: ${{ inputs.release-catalog-config != '' }} uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container with: - config: ${{ inputs.release-build-config }} + config: ${{ inputs.release-catalog-config }} source-artifact-name: ${{ inputs.artifact-name }} source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 268c344c..d203f441 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -305,7 +305,7 @@ jobs: config: >- { "artifact_type": "wheel", - "component_id": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }}, + "release_catalog_key": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} diff --git a/README.md b/README.md index cd01713e..fdcd202e 100644 --- a/README.md +++ b/README.md @@ -108,7 +108,7 @@ bundle. `custom-job.yaml` can be used to produce artifacts, but the generation of extra metadata files are opt-in, not automatic. Supplying a non-empty -`release-build-config` causes the job to upload the additional +`release-catalog-config` causes the job to upload the additional release-build-output artifact; leaving it empty uploads only the original artifact. From 76a8c6bb872b0f72b6d0fb058911d153e772d962 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Mon, 17 Aug 2026 21:41:11 -0500 Subject: [PATCH 09/14] Rename release catalog integration --- .github/workflows/conda-cpp-build.yaml | 4 ++-- .github/workflows/conda-python-build.yaml | 4 ++-- .github/workflows/custom-job.yaml | 10 +++++----- .github/workflows/wheels-build.yaml | 4 ++-- README.md | 9 ++++----- 5 files changed, 15 insertions(+), 16 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 3fbfd756..fb158447 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -227,9 +227,9 @@ jobs: name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} - - name: Create Conda release build-output companion + - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container + uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 7416c23a..2904ffa4 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -232,9 +232,9 @@ jobs: name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} - - name: Create Conda release build-output companion + - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container + uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 6555aa0b..a109e6db 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -107,9 +107,9 @@ on: required: false release-catalog-config: description: >- - Optional JSON configuration for the `shared-actions/release-build-output-dispatch` action. When non-empty, - this job uploads an additional `release-build-output-` GitHub Actions artifact. See - https://github.com/rapidsai/shared-actions/tree/main/release-build-output for configuration details. + Optional JSON configuration for the shared-actions release catalog companion. When non-empty, this job + uploads an additional `release-catalog-` GitHub Actions artifact. See + https://github.com/rapidsai/shared-actions/tree/main/release-catalog for configuration details. default: '' type: string required: false @@ -236,9 +236,9 @@ jobs: name: ${{ inputs.artifact-name }} path: ${{ inputs.file_to_upload }} if-no-files-found: ignore - - name: Create release build-output companion + - name: Create release catalog companion if: ${{ inputs.release-catalog-config != '' }} - uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container + uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 with: config: ${{ inputs.release-catalog-config }} source-artifact-name: ${{ inputs.artifact-name }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index d203f441..d6f02a8f 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -298,9 +298,9 @@ jobs: name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} - - name: Create wheel release build-output companion + - name: Create wheel release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-build-output-dispatch@a18a4a7ac572366c09c15641ec274cc6f15bfb5d # agent/release-build-output-container + uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 with: config: >- { diff --git a/README.md b/README.md index fdcd202e..c17eb4c0 100644 --- a/README.md +++ b/README.md @@ -97,22 +97,21 @@ wheel-tests: Values passed through `secrets:` are redacted everywhere in the GitHub UI, including in logs, and in most cases are replaced with `***`. -### Release build outputs +### Release catalog We add additional metadata files to our builds to help track what dependencies were present at build time (a Software Bill of Materials, SBoM), as well as keeping track of artifacts as we prepare for releases. The standard Conda and wheel builders do this automatically and upload an additional -`release-build-output-` GitHub Actions artifact for every package +`release-catalog-` GitHub Actions artifact for every package bundle. `custom-job.yaml` can be used to produce artifacts, but the generation of extra metadata files are opt-in, not automatic. Supplying a non-empty `release-catalog-config` causes the job to upload the additional -release-build-output artifact; leaving it empty uploads only the original -artifact. +release catalog companion; leaving it empty uploads only the original artifact. See the -[`shared-actions` release-build-output documentation](https://github.com/rapidsai/shared-actions/tree/main/release-build-output) +[`shared-actions` release catalog documentation](https://github.com/rapidsai/shared-actions/tree/main/release-catalog) for the companion layout, configuration schema, examples, and evidence semantics. From 17fcb1ca11d9ff66003731160f112af6f2ae0ca2 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Mon, 17 Aug 2026 23:09:21 -0500 Subject: [PATCH 10/14] pin unified release catalog entries action --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/custom-job.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index fb158447..3bea7d86 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -229,7 +229,7 @@ jobs: - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 2904ffa4..fa1d714e 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -234,7 +234,7 @@ jobs: - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index a109e6db..849e6ec0 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -238,7 +238,7 @@ jobs: if-no-files-found: ignore - name: Create release catalog companion if: ${{ inputs.release-catalog-config != '' }} - uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 with: config: ${{ inputs.release-catalog-config }} source-artifact-name: ${{ inputs.artifact-name }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index d6f02a8f..35aca632 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -300,7 +300,7 @@ jobs: - name: Create wheel release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@45e84f709fde5e3f1b5960ed0510599c5f388333 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 with: config: >- { From bdb908fe041a8a869fe49905ff22fff9d53f7116 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 18 Aug 2026 09:41:09 -0500 Subject: [PATCH 11/14] pin simplified package identity action --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/custom-job.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 3bea7d86..a081606b 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -229,7 +229,7 @@ jobs: - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index fa1d714e..f62138b1 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -234,7 +234,7 @@ jobs: - name: Create Conda release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136 with: config: >- { diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 849e6ec0..3d04c227 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -238,7 +238,7 @@ jobs: if-no-files-found: ignore - name: Create release catalog companion if: ${{ inputs.release-catalog-config != '' }} - uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136 with: config: ${{ inputs.release-catalog-config }} source-artifact-name: ${{ inputs.artifact-name }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 35aca632..6a0fd3f1 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -300,7 +300,7 @@ jobs: - name: Create wheel release catalog companion if: ${{ inputs.upload-artifacts }} - uses: rapidsai/shared-actions/release-catalog-dispatch@c4b135aba0b7c5e9fa97f384505efeb17b8c5aa9 # shared-actions PR 136 + uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136 with: config: >- { From 8d72dfa37d69fe5d45775d1b080610bf8d45d67a Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 18 Aug 2026 10:53:49 -0500 Subject: [PATCH 12/14] use automatic release catalog artifact detection --- .github/workflows/conda-cpp-build.yaml | 1 - .github/workflows/conda-python-build.yaml | 1 - .github/workflows/wheels-build.yaml | 1 - 3 files changed, 3 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index a081606b..466ce19f 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -233,7 +233,6 @@ jobs: with: config: >- { - "artifact_type": "conda", "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index f62138b1..56495461 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -238,7 +238,6 @@ jobs: with: config: >- { - "artifact_type": "conda", "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 6a0fd3f1..f4d72d88 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -304,7 +304,6 @@ jobs: with: config: >- { - "artifact_type": "wheel", "release_catalog_key": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }}, "output_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} } From 7819b70ac0c45907cd4869c1996e84b1cc7b3bbc Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 18 Aug 2026 11:16:23 -0500 Subject: [PATCH 13/14] rename release catalog artifact directory --- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 466ce19f..02dce52a 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -234,7 +234,7 @@ jobs: config: >- { "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, - "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} + "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ env.RAPIDS_SHA }} diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 56495461..baaf82ae 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -239,7 +239,7 @@ jobs: config: >- { "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }}, - "output_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} + "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ env.RAPIDS_SHA }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index f4d72d88..baf35eb5 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -305,7 +305,7 @@ jobs: config: >- { "release_catalog_key": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }}, - "output_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} + "artifact_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} source-sha: ${{ env.RAPIDS_SHA }} From 74214567918aef78643d55c1905b8ae8cfea6d11 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 18 Aug 2026 12:14:20 -0500 Subject: [PATCH 14/14] use inherited release catalog source sha --- .github/workflows/conda-cpp-build.yaml | 1 - .github/workflows/conda-python-build.yaml | 1 - .github/workflows/custom-job.yaml | 1 - .github/workflows/wheels-build.yaml | 1 - 4 files changed, 4 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 02dce52a..7d3a94e6 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -237,7 +237,6 @@ jobs: "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)" diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index baaf82ae..ec1aa605 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -242,7 +242,6 @@ jobs: "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}" diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 3d04c227..fff28a8b 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -242,7 +242,6 @@ jobs: with: config: ${{ inputs.release-catalog-config }} source-artifact-name: ${{ inputs.artifact-name }} - source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()" run: rapids-upload-artifacts-dir "custom-job-$(arch)" diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index baf35eb5..a8e5401a 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -308,7 +308,6 @@ jobs: "artifact_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }} } source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }} - source-sha: ${{ env.RAPIDS_SHA }} - name: Upload additional artifacts if: "!cancelled()"