From 19442513485fd28a7f064bc38520818b5b7dab17 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:59:31 -0400
Subject: [PATCH] fix(release): declare sole workflow publisher and archive
 SBOM contract

---
 .goreleaser.yaml   |  7 +++++++
 agent.codefly.yaml |  3 +++
 release_test.go    | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 release_test.go

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 8aa14a5..5943d9f 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,5 +1,12 @@
 version: 2
 
+sboms:
+  - id: archives
+    artifacts: archive
+    documents:
+      - "${artifact}.sbom.json"
+    disable: false
+
 builds:
   - id: darwin
     env:
diff --git a/agent.codefly.yaml b/agent.codefly.yaml
index 74c88a8..809cce9 100644
--- a/agent.codefly.yaml
+++ b/agent.codefly.yaml
@@ -2,3 +2,6 @@ publisher: codefly.dev
 kind: codefly:service
 name: temporal
 version: 0.0.18
+release:
+  owner: workflow
+  workflow: releaser.yml
diff --git a/release_test.go b/release_test.go
new file mode 100644
index 0000000..d15f99c
--- /dev/null
+++ b/release_test.go
@@ -0,0 +1,39 @@
+package main
+
+import (
+	"os"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestReleaseDeclaresOnePublisherAndArchiveSBOMs(t *testing.T) {
+	read := func(path string, target any) {
+		t.Helper()
+		payload, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := yaml.Unmarshal(payload, target); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var manifest struct {
+		Release struct{ Owner, Workflow string }
+	}
+	read("agent.codefly.yaml", &manifest)
+	if manifest.Release.Owner != "workflow" || manifest.Release.Workflow != "releaser.yml" {
+		t.Fatal("the tag workflow must be the sole artifact publisher")
+	}
+	var config struct {
+		SBOMs []struct {
+			Artifacts string
+			Documents []string
+			Disable   bool
+		} `yaml:"sboms"`
+	}
+	read(".goreleaser.yaml", &config)
+	if len(config.SBOMs) != 1 || config.SBOMs[0].Artifacts != "archive" || config.SBOMs[0].Disable || len(config.SBOMs[0].Documents) != 1 || config.SBOMs[0].Documents[0] != "${artifact}.sbom.json" {
+		t.Fatal("each published archive must carry its canonical SBOM")
+	}
+}