release: generate release catalog companions for build artifacts

.github/workflows/conda-cpp-build.yaml

@@ -226,6 +226,17 @@ jobs:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Create Conda release catalog companion
+        if: ${{ inputs.upload-artifacts }}
+        uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)"

.github/workflows/conda-python-build.yaml

@@ -231,6 +231,17 @@ jobs:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Create Conda release catalog companion
+        if: ${{ inputs.upload-artifacts }}
+        uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"

.github/workflows/custom-job.yaml

@@ -105,6 +105,14 @@ on:
         default: false
         type: boolean
         required: false
+      release-catalog-config:
+        description: >-
+          Optional JSON configuration for the shared-actions release catalog companion. When non-empty, this job
+          uploads an additional `release-catalog-<artifact-name>` GitHub Actions artifact. See
+          https://github.com/rapidsai/shared-actions/tree/main/release-catalog for configuration details.
+        default: ''
+        type: string
+        required: false
 
 defaults:
   run:
@@ -228,6 +236,12 @@ jobs:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.file_to_upload }}
           if-no-files-found: ignore
+      - name: Create release catalog companion
+        if: ${{ inputs.release-catalog-config != '' }}
+        uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136
+        with:
+          config: ${{ inputs.release-catalog-config }}
+          source-artifact-name: ${{ inputs.artifact-name }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "custom-job-$(arch)"

.github/workflows/wheels-build.yaml

@@ -298,6 +298,17 @@ jobs:
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
 
+      - name: Create wheel release catalog companion
+        if: ${{ inputs.upload-artifacts }}
+        uses: rapidsai/shared-actions/release-catalog-dispatch@6cdff151c40c97551fdf2abd5d977580f94ed7e1 # shared-actions PR 136
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"

README.md

@@ -96,3 +96,22 @@ wheel-tests:
 ```
 
 Values passed through `secrets:` are redacted everywhere in the GitHub UI, including in logs, and in most cases are replaced with `***`.
+
+### Release catalog
+
+We add additional metadata files to our builds to help track what dependencies
+were present at build time (a Software Bill of Materials, SBoM), as well as
+keeping track of artifacts as we prepare for releases. The standard Conda and
+wheel builders do this automatically and upload an additional
+`release-catalog-<artifact-name>` GitHub Actions artifact for every package
+bundle.
+
+`custom-job.yaml` can be used to produce artifacts, but the generation of extra
+metadata files are opt-in, not automatic. Supplying a non-empty
+`release-catalog-config` causes the job to upload the additional
+release catalog companion; leaving it empty uploads only the original artifact.
+
+See the
+[`shared-actions` release catalog documentation](https://github.com/rapidsai/shared-actions/tree/main/release-catalog)
+for the companion layout, configuration schema, examples, and evidence
+semantics.