Add historical backfill mode to create-release workflow

This commit is contained in:
rcourtman 2026-04-22 17:43:37 +01:00
parent 16ad67a9b5
commit 9c2e3d5ffb
5 changed files with 94 additions and 15 deletions

View file

@ -1071,8 +1071,9 @@ checksum-only trust and can publish a shareable non-image software inventory
alongside the signed binaries.
Historical published-release repair must flow through
`scripts/backfill-release-assets.sh` and
`.github/workflows/backfill-release-assets.yml`, which download the
already-published packet and regenerate only the derived integrity assets
`.github/workflows/backfill-release-assets.yml` or the canonical
`.github/workflows/create-release.yml` historical backfill mode, which download
the already-published packet and regenerate only the derived integrity assets
(`checksums.txt`, `.sha256`, `.sig`, `.sshsig`, and the canonical
release-packet SBOM`) from those shipped bytes instead of rebuilding binaries
from the current branch tip.