Skip to content

Release process

Release automation follows the supply-chain pattern used by Kollect and MKurator (see ADR-0009). Mandatory v0 artifacts (DQ 22): CGO-free binary tarballs on GitHub Releases plus a multi-arch container on GHCR — no Helm or Kustomize.

Versioning

  • Tags: vX.Y.Z (SemVer), e.g. v0.1.0.
  • Commits: gitmoji conventional format (:sparkles: feat(scope): summary).
  • Changelog: generated by git-cliff from conventional commits on main (cliff.toml).

Prerequisites

  1. Green CI on main (task check, docs, Scorecard, CodeQL).
  2. GitHub release environment configured for the repo (Settings → Environments → New environment → name release; optional required reviewers). OIDC for cosign uses this environment — create it before the first tagged release if it does not exist.
  3. GHCR package visibility set as intended for ghcr.io/platformrelay/ibm-mq-mcp.

Cut a release

bash git checkout main git pull task check git tag -a v0.1.0 -m "v0.1.0" git push origin v0.1.0

Pushing a v*.*.* tag triggers .github/workflows/release.yaml.

What the release workflow does

  1. Container — multi-arch (linux/amd64, linux/arm64) build and push to ghcr.io/platformrelay/ibm-mq-mcp:<version> and :<tag>.
  2. Trivy — fails on CRITICAL/HIGH vulnerabilities (unfixed ignored).
  3. cosign — keyless OIDC signature on the image digest.
  4. BuildKit — SBOM + provenance: mode=max on push.
  5. SPDX SBOM — dist/sbom.spdx.json via anchore/sbom-action.
  6. Attestations — actions/attest SLSA provenance + SBOM to GHCR; release asset provenance from checksums.txt.
  7. Binaries — CGO-free tarballs for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 under dist/.
  8. Signed release blobs — cosign sign-blob on tarballs, SBOM, checksums.
  9. GitHub Release — changelog + install notes, all assets attached.

Generation failure for SBOM, provenance, or signing fails the job (no silent omission).

Verify a release

Use the repository slug GitHub OIDC embeds in cosign certificates (${GITHUB_REPOSITORY} — for this repo, PlatformRelay/IBM-MQ-MCP-Server):

```bash VERSION=0.1.0 IMAGE=ghcr.io/platformrelay/ibm-mq-mcp DIGEST="$(crane digest ${IMAGE}:${VERSION})" GITHUB_REPOSITORY=PlatformRelay/IBM-MQ-MCP-Server

cosign verify \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/.+" \ "${IMAGE}@${DIGEST}"

sha256sum -c checksums.txt ```

Local container smoke

bash task docker:build docker inspect --format '{{.Config.User}}' ibm-mq-mcp:dev # expect 65532:65532

CI runs the same build (without push) in the docker-build job.

Container HEALTHCHECK, readiness probes, and Kubernetes securityContext.readOnlyRootFilesystem guidance are deferred to OBS-001 (health/readiness/deployment hardening) and future deployment docs — not part of the v0 release image contract.

Manual re-run

Use workflow_dispatch on the Release workflow with an existing tag to rebuild assets (e.g. after fixing a pipeline bug).