[mnafees]

Description

Implements signing and SBOM generation for all GHCR images.

Type of change

• New feature (non-breaking change which adds functionality)

---

🤖 AI Disclosure

• I acknowledge that an LLM was used in the creation of this Pull Request, in accordance with Hatchet's AI_POLICY.md.

• Details: [e.g. generating tests, writing docs] SBOM and cosign implementation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hatchet-docs	Ready	Preview	Oct 30, 2026 5:12pm UTC

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change reaches Hatchet’s published container images across release channels.

The PR appears safe to merge, with a non-blocking correction needed to the documented image coverage.

Summary

Adds image signing and SBOMs to the release workflows.

• Hatchet images now carry workflow signatures and platform SBOMs.

_{Reviews (1) · Last reviewed commit: "verify in CI" · Reviewed by Greptile}