feat: add release build output manifests

Created with Codex (GPT-5).

Author: msarahan

.github/workflows/conda-cpp-build.yaml

@@ -44,6 +44,16 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      release-build-output:
+        type: boolean
+        default: false
+        required: false
+        description: "Generate a release-build-output companion for each uploaded Conda bundle"
+      release-unit:
+        type: string
+        default: ''
+        required: false
+        description: "Stable release-platform unit ID; required when release-build-output is true"
       matrix_filter:
         description: |
           jq expression which modifies the matrix.
@@ -226,6 +236,19 @@ jobs:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Create Conda release build-output companion
+        if: ${{ inputs.upload-artifacts && inputs.release-build-output }}
+        uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses]
+        env:
+          SHARED_ACTIONS_REPO: rapidsai/shared-actions
+          SHARED_ACTIONS_REF: agent/release-build-output-dispatch
+        with:
+          artifact-type: conda
+          output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+          release-unit: ${{ inputs.release-unit }}
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ inputs.sha || github.sha }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)"

.github/workflows/conda-python-build.yaml

@@ -44,6 +44,16 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      release-build-output:
+        type: boolean
+        default: false
+        required: false
+        description: "Generate a release-build-output companion for each uploaded Conda bundle"
+      release-unit:
+        type: string
+        default: ''
+        required: false
+        description: "Stable release-platform unit ID; required when release-build-output is true"
       matrix_filter:
         description: |
           jq expression which modifies the matrix.
@@ -231,6 +241,19 @@ jobs:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Create Conda release build-output companion
+        if: ${{ inputs.upload-artifacts && inputs.release-build-output }}
+        uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses]
+        env:
+          SHARED_ACTIONS_REPO: rapidsai/shared-actions
+          SHARED_ACTIONS_REF: agent/release-build-output-dispatch
+        with:
+          artifact-type: conda
+          output-directory: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+          release-unit: ${{ inputs.release-unit }}
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ inputs.sha || github.sha }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"

.github/workflows/custom-job.yaml

@@ -105,6 +105,36 @@ on:
         default: false
         type: boolean
         required: false
+      release-build-output:
+        description: "Generate a release-build-output companion for the uploaded artifact bundle"
+        default: false
+        type: boolean
+        required: false
+      release-unit:
+        description: "Stable release-platform unit ID; required when release-build-output is true"
+        default: ''
+        type: string
+        required: false
+      release-package:
+        description: "JSON package identity shared by the bundle; mutually exclusive with release-package-file"
+        default: ''
+        type: string
+        required: false
+      release-package-file:
+        description: "Producer-created package JSON relative to release-output-directory"
+        default: ''
+        type: string
+        required: false
+      release-artifacts:
+        description: "JSON primary-artifact and evidence descriptors relative to release-output-directory"
+        default: ''
+        type: string
+        required: false
+      release-output-directory:
+        description: "Directory containing the primary artifact paths described by release-artifacts"
+        default: '.'
+        type: string
+        required: false
 
 defaults:
   run:
@@ -228,6 +258,21 @@ jobs:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.file_to_upload }}
           if-no-files-found: ignore
+      - name: Create release build-output companion
+        if: ${{ inputs.release-build-output }}
+        uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses]
+        env:
+          SHARED_ACTIONS_REPO: rapidsai/shared-actions
+          SHARED_ACTIONS_REF: agent/release-build-output-dispatch
+        with:
+          artifact-type: custom
+          output-directory: ${{ inputs.release-output-directory }}
+          release-artifacts: ${{ inputs.release-artifacts }}
+          release-package: ${{ inputs.release-package }}
+          release-package-file: ${{ inputs.release-package-file }}
+          release-unit: ${{ inputs.release-unit }}
+          source-artifact-name: ${{ inputs.artifact-name }}
+          source-sha: ${{ inputs.sha || github.sha }}
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "custom-job-$(arch)"

.github/workflows/wheels-build.yaml

@@ -75,6 +75,16 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      release-build-output:
+        type: boolean
+        default: false
+        required: false
+        description: "Generate a release-build-output companion for each uploaded wheel bundle"
+      release-unit:
+        type: string
+        default: ''
+        required: false
+        description: "Stable release-platform unit ID; required when release-build-output is true"
       extra-repo:
         required: false
         type: string
@@ -298,6 +308,19 @@ jobs:
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
 
+      - name: Create wheel release build-output companion
+        if: ${{ inputs.upload-artifacts && inputs.release-build-output }}
+        uses: rapidsai/shared-actions/release-build-output-dispatch@agent/release-build-output-dispatch # zizmor: ignore[unpinned-uses]
+        env:
+          SHARED_ACTIONS_REPO: rapidsai/shared-actions
+          SHARED_ACTIONS_REF: agent/release-build-output-dispatch
+        with:
+          artifact-type: wheel
+          output-directory: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
+          release-unit: ${{ inputs.release-unit }}
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ inputs.sha || github.sha }}
+
       - name: Upload additional artifacts
         if: "!cancelled()"
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"

README.md

@@ -20,6 +20,75 @@ Reusable workflows must be placed in the `.github/workflows` directory as mentio
 
 ## Usage
 
+### release-build-output
+
+Release build-output companions are created inside the producer job by the
+[`release-build-output-dispatch`](https://github.com/rapidsai/shared-actions/tree/main/release-build-output-dispatch)
+shared action. Running beside the build keeps the producer's matrix,
+source-artifact name, and original files authoritative and avoids a second
+runner and artifact download.
+
+The standard wheel and Conda builders expose opt-in `release-build-output` and
+`release-unit` inputs. The shared action reads exact package metadata from the
+built files and uploads `release-build-output-<artifact-name>`:
+
+```yaml
+wheel-build-nx-cugraph:
+  uses: rapidsai/shared-workflows/.github/workflows/wheels-build.yaml@codex/release-build-output-manifests
+  with:
+    # existing build inputs omitted
+    release-build-output: true
+    release-unit: wheel:nx-cugraph
+```
+
+`custom-job.yaml` exposes the same opt-in plus `release-output-directory`,
+`release-artifacts`, and either `release-package` or
+`release-package-file`. Descriptors may name producer-supplied SBOM,
+provenance, and signature sidecars relative to the output directory. Each path
+or glob must resolve to exactly one file; the action never guesses a release
+artifact.
+
+```yaml
+cuvs-java-build:
+  uses: rapidsai/shared-workflows/.github/workflows/custom-job.yaml@codex/release-build-output-manifests
+  with:
+    # existing build inputs omitted
+    artifact-name: cuvs-java-cuda12.9.1
+    file_to_upload: java/cuvs-java/target/
+    release-build-output: true
+    release-output-directory: java/cuvs-java/target
+    release-unit: maven:cuvs-java
+    release-package-file: cuvs-java.release-package.json
+    release-artifacts: '[{"path":"cuvs-java-*-x86_64-cuda*.jar"}]'
+```
+
+The release coordinator downloads both artifacts into the same directory, for
+example `release-build-outputs/cuvs-java/cuda12.9.1/`. The resulting tree has
+one `release-build-output.json` per producer job and is consumed directly by
+`rapids-release shadow file`. It does not require Artifactory.
+
+The companion artifact also carries `release-build-metadata.json`. It records
+the artifact identity, manifest filename, GitHub build identity, and one
+`metadata.artifacts` entry per primary artifact. Each entry explicitly sets
+`sbom_kind` to `producer-dependency` or `generated-identity`. SBOM and
+provenance paths remain authoritative in `release-build-output.json`; supplied
+sidecars are copied under `release-evidence/` so the companion is independently
+self-contained.
+
+When no SBOM is selected, the action generates an SPDX artifact-identity
+envelope containing package identity and the primary artifact SHA-256. It is
+classified as `generated-identity`, contains no dependency inventory, and must
+not be reported as a producer-supplied dependency SBOM. A descriptor-selected
+producer SBOM is instead classified as `producer-dependency`.
+
+The in-development branch ref above is intentional for rollout canaries. It
+allows downstream validation before this contract is merged to
+`shared-workflows/main`.
+
+The cross-repository enrollment inventory, blockers, and proposed PR sequence
+are maintained in
+[`rapidsai/build-infra#381`](https://github.com/rapidsai/build-infra/issues/381).
+
 ### matrix_filter
 
 Several of the workflows in this project have matrices (combinations of workflow inputs) expressed in inline YAML/JSON.