Problem
The SBOM workflow says it attaches SBOM files when github.event_name == release, but Craft releases are created by the tag-driven release workflow. The release created with the workflow token does not produce a follow-up SBOM release-event run, so the attachment step never executes.
v0.0.92 evidence
- The SBOM workflow ran successfully for the v0.0.92 tag push: https://github.com/craft-native/craft/actions/runs/35240362915
- There is no corresponding release-event SBOM run for that commit.
- The published release contains only craft-darwin-arm64.zip, craft-darwin-x64.zip, craft-linux-x64.zip, craft-windows-x64.zip, and release-manifest.json.
- craft-sbom.json, full-sbom.cyclonedx.json, and full-sbom.spdx.json are absent.
Release: https://github.com/craft-native/craft/releases/tag/v0.0.92
Expected
The same tag-driven release path should attach the generated CycloneDX and SPDX documents to the final GitHub release, with a verification step that fails if expected assets are missing. Avoid relying on a workflow-token-created release event to launch another workflow.
Acceptance ideas
- Make the release workflow consume the tag SBOM artifact and upload it before declaring publication complete, or explicitly invoke a reusable SBOM workflow.
- Ensure tag and package versions agree before attachment (related to #272).
- Verify release assets by name after publication.
Discovered during the post-merge release audit for #254, #242, and #220.