Add release artifact sync workflow

[welteki]

Description

Adds a release artifact sync workflow for copying release binaries from an OCI artifact bundle into GitHub Releases.

The workflow can run nightly or through workflow_dispatch. When a tag is provided, it syncs that tag explicitly and overwrites matching release assets. Without a tag, it lists tags from ghcr.io/openfaasltd/inlets-pro-artifacts and only syncs releases that are missing from the public repository.

The release sync logic is kept in hack/sync-release-artifacts.sh so it can be tested locally with a source OCI artifact, target repository, and optional tag.

Motivation and context

This is part of a series of changes to automate publishing and release syncing between the private and public inlets-pro repositories.

How has this been tested

Tested the script locally against a public OCI artifact bundle and a test repository, including the explicit tag sync path and the no-tag skip path.

Also tested the workflow end-to-end through workflow_dispatch against a test repository. The run completed successfully and uploaded the expected release binaries and checksums.

[welteki]

The tag concern is understood, but in this repo there is no corresponding public commit for the private build. Public release tags are intentionally just anchors on the public default branch, so creating a missing release tag at the current public branch head is acceptable for this sync workflow.

[alexellis]

If the public repository intentionally lacks those git tags, the sync job needs a reliable source for the correct target commit and should create tags with --target rather than letting gh default to the current branch tip.

Not sure if there's something in this - but the public releases are not code-based - they're just buckets for uploads.

Maybe add a comment to help the review understand the intent.

[welteki]

Maybe add a comment to help the review understand the intent.

I added a comment in the code so that future reviewers can see why the concern is not really applicable here.

[reviewfn]

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

• Adds a scheduled and manually-dispatchable workflow to sync release assets from an OCI artifact image into GitHub Releases.
• Adds hack/sync-release-artifacts.sh to list source tags, skip already-published releases in bulk mode, and upload extracted artifacts with --clobber.
• The script handles explicit tag syncs separately from the missing-release sync path.
• The workflow grants contents: write, which is required for release creation and upload.
• One security issue should be addressed before merge: a mutable third-party action is used in a write-privileged workflow.

Approval rating (1-10)

7/10. The sync logic is focused, but the write-privileged workflow should not depend on a mutable third-party action ref.

Summary per file

Summary per file

File path	Summary
.github/workflows/sync-release-artifacts.yml	Adds scheduled/manual release artifact sync workflow.
hack/sync-release-artifacts.sh	Adds OCI export and GitHub Release upload script.

Overall Assessment

The implementation is small and mostly aligns with the stated goal: export artifacts from a tagged OCI bundle, create missing releases, and upload assets. The main issue is supply-chain exposure in the workflow. Because the job has contents: write and can create or overwrite release assets, every action in that job needs to be pinned or otherwise tightly controlled.

Detailed Review

Detailed Review

Findings

High: Mutable third-party action runs with release-write permissions

.github/workflows/sync-release-artifacts.yml:25-28

The workflow grants contents: write at job scope and then executes alexellis/arkade-get@master. Since master is a mutable branch in a third-party repository, a future change or compromise of that action can run in this workflow with the repository token available and can create, alter, or replace release artifacts. That is a direct supply-chain risk for the public release channel this PR is automating.

Pin the action to an immutable commit SHA, or avoid the third-party action in the write-privileged job by installing crane through a pinned and checksummed download. For example, the workflow can use a full commit SHA for alexellis/arkade-get, and the repo should have a process for periodically updating that pin deliberately.

AI agent details.

Agent processing time: 1m28.343s
Environment preparation time: 3.053s
Total time from webhook: 1m33.839s

[welteki]

High: Mutable third-party action runs with release-write permissions

We follow the same pattern for the arkade-get action in all our workflows, pinning to @master. The arkade-get action is also owned by us which minimises the risk.