fix(release): declare sole workflow publisher and archive SBOM contract

.goreleaser.yaml

@@ -1,5 +1,12 @@
 version: 2
 
+sboms:
+  - id: archives
+    artifacts: archive
+    documents:
+      - "${artifact}.sbom.json"
+    disable: false
+
 builds:
   - id: darwin
     env:

agent.codefly.yaml

@@ -2,3 +2,6 @@ publisher: codefly.dev
 kind: codefly:service
 name: dynamodb
 version: 0.0.11
+release:
+  owner: workflow
+  workflow: releaser.yml

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/lib/pq v1.12.3
 	github.com/stretchr/testify v1.12.1
 	google.golang.org/grpc v1.83.2
+	gopkg.in/yaml.v3 v3.0.1
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -123,7 +124,6 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
 	sigs.k8s.io/kustomize/api v0.21.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect

release_test.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestReleaseDeclaresOnePublisherAndArchiveSBOMs(t *testing.T) {
+	read := func(path string, target any) {
+		t.Helper()
+		payload, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := yaml.Unmarshal(payload, target); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var manifest struct {
+		Release struct{ Owner, Workflow string }
+	}
+	read("agent.codefly.yaml", &manifest)
+	if manifest.Release.Owner != "workflow" || manifest.Release.Workflow != "releaser.yml" {
+		t.Fatal("the tag workflow must be the sole artifact publisher")
+	}
+	var config struct {
+		SBOMs []struct {
+			Artifacts string
+			Documents []string
+			Disable   bool
+		} `yaml:"sboms"`
+	}
+	read(".goreleaser.yaml", &config)
+	if len(config.SBOMs) != 1 || config.SBOMs[0].Artifacts != "archive" || config.SBOMs[0].Disable || len(config.SBOMs[0].Documents) != 1 || config.SBOMs[0].Documents[0] != "${artifact}.sbom.json" {
+		t.Fatal("each published archive must carry its canonical SBOM")
+	}
+}