From ea0efbecb057030db609bd1d97e067114ae6a439 Mon Sep 17 00:00:00 2001
From: Oliver Meyer <oliverm@aignostics.com>
Date: Fri, 24 Apr 2026 09:09:52 +0200
Subject: [PATCH 1/2] ci: pass release version to ketryx on release/v* branches

When CI/CD runs on a release/v* branch, extract the semver from the
branch name and pass it as the Ketryx `version` input instead of
`commit-sha`. This associates the build with the correct Ketryx release
entry rather than a transient commit SHA, enabling proper compliance
approval collection during the prepare-release phase.

On all other contexts (PRs, main, tags), the existing commit-sha
behaviour is unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/_ketryx_report_and_check.yml | 11 ++++++++---
 .github/workflows/ci-cd.yml                    | 14 ++++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_ketryx_report_and_check.yml b/.github/workflows/_ketryx_report_and_check.yml
index 69d14565c..bcd8c0555 100644
--- a/.github/workflows/_ketryx_report_and_check.yml
+++ b/.github/workflows/_ketryx_report_and_check.yml
@@ -7,9 +7,13 @@ on:
         description: 'Commit message to check for skip markers'
         required: false
         type: string
-
       commit-sha:
-        required: true
+        description: 'Commit SHA to associate the build with (used when version is not set)'
+        required: false
+        type: string
+      version:
+        description: 'Ketryx version ID to associate the build with; takes precedence over commit-sha (use on release/v* branches)'
+        required: false
         type: string
     secrets:
       KETRYX_PROJECT:
@@ -59,7 +63,8 @@ jobs:
         with:
           project: ${{ secrets.KETRYX_PROJECT }}
           api-key: ${{ secrets.KETRYX_API_KEY }}
-          commit-sha: ${{ inputs.commit-sha }}
+          commit-sha: ${{ inputs.version == '' && inputs.commit-sha || '' }}
+          version: ${{ inputs.version }}
           build-name: "ci-cd"
           test-junit-path: test-results/junit_*.xml
           cyclonedx-json-path: |
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index aed9abe24..9a33532ba 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -35,12 +35,25 @@ jobs:
       contents: read
     outputs:
       commit_message: ${{ steps.get-commit-message.outputs.commit_message }}
+      release_version: ${{ steps.get-release-version.outputs.release_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
+      - name: Get release version from branch name
+        id: get-release-version
+        shell: bash
+        env:
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [[ "$GITHUB_REF_NAME" =~ ^release/v(.+)$ ]]; then
+            echo "release_version=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          else
+            echo "release_version=" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Get commit message
         id: get-commit-message
         shell: bash
@@ -166,6 +179,7 @@ jobs:
     uses: ./.github/workflows/_ketryx_report_and_check.yml
     with:
       commit-sha: ${{ github.event.pull_request.head.sha || github.sha }}
+      version: ${{ needs.get-commit-message.outputs.release_version }}
       commit_message: ${{ needs.get-commit-message.outputs.commit_message }}
     permissions:
       attestations: write

From cc50636facb936595e378719c4d1c76118e13b08 Mon Sep 17 00:00:00 2001
From: Oliver Meyer <oliverm@aignostics.com>
Date: Fri, 24 Apr 2026 09:10:31 +0200
Subject: [PATCH 2/2] ci: run CI/CD for PRs targeting release/v* branches

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/ci-cd.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 9a33532ba..6da79b714 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -8,7 +8,9 @@ on:
     tags:
       - "v*.*.*"
   pull_request:
-    branches: [main]
+    branches:
+      - "main"
+      - "release/v*"
     types: [opened, synchronize, reopened]
   release:
     types: [created]