.github/workflows/release.yml:140

• docker buildx imagetools inspect ${IMAGE_NAME}:${TAG} inspects the multi-arch manifest list at the registry. At this point in the loop, only the current architecture (linux/${ARCH_TAG}) has been pushed to that tag — the other architecture is pushed by a separate matrix job. Depending on timing/ordering between the two arch runners, the .SBOM.CycloneDX field for ${TAG} (which already contains -${ARCH_TAG}) should be a single-platform SBOM, but the --format '{{ json .SBOM.CycloneDX }}' output for a single-platform image is keyed by platform (e.g. {"linux/amd64": {...}}), not a bare CycloneDX document. The resulting sbom-*.cdx.json will therefore not be a valid CycloneDX file consumable by standard tooling. Consider using --format '{{ json (index .SBOM "linux/<arch>").SPDX }}'-style indexing, or docker buildx imagetools inspect --raw plus extraction, to produce a real CycloneDX document.

                            docker buildx imagetools inspect "${IMAGE_NAME}:${TAG}" \
                                --format '{{ json .SBOM.CycloneDX }}' > "sboms/sbom-${TAG}.cdx.json" || \
                                echo "Warning: Could not extract SBOM for ${TAG}"

.github/workflows/release.yml:171

• The "Upload SBOMs" step has no if: condition, unlike the immediately preceding "Upload aggregated tags" step (line 160) which is gated on github.event_name != 'workflow_dispatch' || inputs.publish. When a user triggers the workflow via workflow_dispatch with publish: false, PUSH will be false, the SBOM extraction block at line 136 is skipped, and sboms/ will not exist — if-no-files-found: ignore will avoid a hard failure, but the step still runs unnecessarily and clutters the run with an empty/skipped artifact. For consistency with the adjacent upload step, consider adding the same if: guard.

            -   name: Upload SBOMs
                uses: actions/upload-artifact@v7
                with:
                    name: sboms_${{ matrix.runner }}_${{ matrix.build.tag }}_${{ matrix.build.php }}_${{ matrix.build.distro }}_${{ matrix.build.version-override }}_${{ matrix.build.latest-tag }}
                    path: sboms/
                    if-no-files-found: ignore

.github/workflows/release.yml:134

• The PR description states that this change extracts the CycloneDX SBOM from each image's attestation, writes it under sboms/, and uploads the SBOM files as build artifacts. However, the diff only adds --sbom=true to the docker buildx build invocation; there are no steps that extract the SBOM (e.g. via docker buildx imagetools inspect ... --format '{{ json .SBOM }}') or upload it via actions/upload-artifact. Either the SBOM extraction/upload steps are missing from this PR, or the description should be updated to reflect that only SBOM generation during the build is being enabled.

                        docker buildx build --output "type=image,push=$PUSH" \
                            --provenance=false \
                            --sbom=true \
                            --platform "linux/${ARCH_TAG}" \
                            --target="pimcore_php_$imageVariant" \
                            --build-arg PHP_VERSION="${PHP_VERSION}" \
                            --build-arg DEBIAN_VERSION="${DEBIAN_VERSION}" \
                            ${TAGS} .

.github/workflows/release.yml:134

• Switching from docker build to docker buildx build changes where the resulting image ends up. With --output type=image,push=false and the default docker-container buildx driver (which setup-buildx-action configures), the built image is kept in the builder's cache and is not loaded into the local Docker daemon. As a consequence, the subsequent docker inspect ${IMAGE_NAME}:${TAG} on line 136 will always fail when PUSH=false (it is currently hidden by || true), making the inspect step useless for dry-run/workflow_dispatch runs without publish. If the intent is to keep docker inspect working in non-publishing runs, add --load (and drop the second platform/SBOM in that path) or switch to type=docker when PUSH=false.

                        docker buildx build --output "type=image,push=$PUSH" \
                            --provenance=false \
                            --sbom=true \
                            --platform "linux/${ARCH_TAG}" \
                            --target="pimcore_php_$imageVariant" \
                            --build-arg PHP_VERSION="${PHP_VERSION}" \
                            --build-arg DEBIAN_VERSION="${DEBIAN_VERSION}" \
                            ${TAGS} .