ci(win-hw-wim): commit baked-WIM release notes to sboms/ like the other Windows images - #859
Merged
Conversation
…er images Adds the two pieces that live on main: an upload-artifact step for the release notes the bake now generates, and an sbom job calling the same reusable upload-release-notes.yml every other Windows image build uses. Baked WIMs land in sboms/ alongside the gallery images instead of shipping with no inventory. The kickoff on the pipeline branch exports the filename as sbom_file, mirroring how sig-*.yml exports sharedimageversion, because the build id is generated by New-WinHwWim and isn't knowable from here. No `if: always()` on the sbom job, unlike the parallel-build workflows: a failed bake uploads no artifact and the reusable workflow errors on an empty download, which would report the same failure twice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Gives the Windows HW WIM bake the same release-notes/SBOM flow every other Windows image build has. Two pieces live here on
main:Upload Release Notes Artifactstep in thebuildjobsbomjob calling the shared./.github/workflows/upload-release-notes.ymlThe generation half is on
nuc-wim-pipeline(73afd13).Why
Baked WIMs shipped with no inventory while every Azure gallery image gets one committed to
sboms/. This closes that gap using the existing mechanism rather than a parallel one.How it mirrors the gallery images
azure.pkr.hclwin-hw-wim.pkr.hclSet-ReleaseNotesfileprovisioner,direction = download<config>-<version>.md<image>-<buildid>.md)upload-release-notes.yml→sboms/on mainBecause Packer runs on the ephemeral build VM rather than the runner, the notes are published to blob (
_status/sbom/, plus a copy beside the WIM incaptured/WIMs/<image>/as provenance) and the kickoff pulls them down, exporting the filename assbom_file— the same shape assharedimageversioninsig-*.yml. The build id is generated byNew-WinHwWim, so it isn't knowable from the workflow.Note for reviewers: a shared-module fix was required
Get-GenericWorkerVersion,Get-LiveLogVersion,Get-WorkerRunnerVersionandGet-ProxyVersionallStart-Processtheir binary with no existence check.Start-Processon a missing path throws a terminating error, whichSet-ReleaseNotes'traprethrows.The win-hw-wim bake role excludes
windows_worker_runnerby design — generic-worker and worker-runner are installed at deploy time — so all four would have thrown and failed the build immediately before Sysprep, losing a ~2h bake. They now return nothing when the binary is absent, andShow-TaskclusterBinariesdrops the blank rows that would otherwise appear.No behaviour change for the gallery images, where those binaries are present. Verified the missing-binary path: 2-of-4 present gives a clean 2-row table, 0-of-4 gives an empty section rather than an error. That fix rides on the pipeline branch and reaches
mainwith PR #830.Coverage caveat
The notes inventory what the WIM ships, so software installed at deploy time (the Taskcluster binaries) is absent by design. Also inherited from the shared function: output is UTF-16LE markdown, not a machine-readable SBOM — noted, not changed here.
Testing
Not yet exercised end-to-end; the next
win11-24h2-hwbake is the first real run. Both halves are best-effort on the build side — a good WIM is never failed over its release notes.🤖 Generated with Claude Code