Versioned releases and SBOMs for partner runner images

[ubiratansoares]

Type of issue

• Error when running a workflow.
• Request for additional tools or software for an existing image.
• Request for a new image, Linux or Windows.
• Other

Describe the issue
As of the time this issue is being filled, Runner images provided by Github are versioned (example), and are frequently updated. In addition to that, Github provides SBOMs describing the whole suite of installed software in a given Runner image. This artifact eventually makes it easier to troubleshoot whether some CI failure was introduced by some software component update in the latest image release, even whether minor or patch, since we can always refer to different versions of the runner image as per setup job step of a given Workflow, getting versions of images used in different commits or workflow runs, and diff SBOMs.

Right now, partner runner images, especially ARM, do not follow this approach, which makes it hard to troubleshoot whether CI failures eventually are attached to some software component that differs by some versions between aarch64 images and it x86_64 counterpart.

To Reproduce
N/A

Expected behavior
We should have versioned releases of partner runner images, alongside with SBOMs, as we have with Github provided images. Ideally, we should also have the changelog regarding what changed between image releases.

Screenshots
N/A

Desktop (please complete the following information):

• OS: Ubuntu 22.04 and Ubuntu 24.04

Additional context
N/A

[MikeMcC399]

See #79 (comment)

Confusingly for Ubuntu 22 / 24 there are two files provided; the ones linked in the README have no version information, however they contain a link to a second file with version information.

For Windows there is only one file (which is currently outdated).

[ubiratansoares]

@MikeMcC399 there are software versions in markdowns around, yes, but SBOMs are a standard that favors automations.

I don't think we can replace SBOMs with tables within some .md file, imho the ideal would be having both, with information within .md being generated from the corresponding SBOM file.

[MikeMcC399]

@ubiratansoares

I'm sorry, I misunderstood and you are asking for SBOMs in a formal standard format, not a Markdown file. The ones for GitHub runner images are referred to in the documentation:

https://docs.github.com/en/actions/reference/security/secure-use#reviewing-the-supply-chain-for-github-hosted-runners

SBOMs are available for Ubuntu, Windows, and macOS runner images maintained by GitHub. You can locate the SBOM for your build in the release assets at https://github.com/actions/runner-images/releases. An SBOM with a filename in the format of sbom.IMAGE-NAME.json.zip can be found in the attachments of each release.

This type of file is missing for partner images, and the documentation says only:

For third-party images, such as the images for ARM-powered runners, you can find details of the software that's included in the image in the actions/partner-runner-images repository.