Release Groups
Bundle related projects into a single unit for shared reporting, policy enforcement, and release tracking.
Overview
A release group collects multiple projects into a single logical unit, for example, all the services that ship together as one product release. Within a release group, each named release pins the exact revision of every project that was included at that point in time.
Creating a Release Group
Create a release group, add projects, and configure your first release.
Managing Releases
Clone, edit, and manage releases within a release group to track compliance at specific points in time.
Issues
Review licensing, security, and quality issues aggregated across all projects in a release group.
Inventory & Licenses
Browse the unified dependency inventory and license breakdown across all projects in a release group.
Reports
Generate licensing, vulnerability, SBOM, and remediation guidance reports across all projects in a release group.
Release Group Settings
Configure policies, report defaults, and portal visibility for a release group.
Permissions
Understand the permission model for release groups; who can create, edit, scan, set policies, and generate reports.
Key concepts
Release group, the named collection of projects. Think of it as the product or product line. A release group persists across time and accumulates releases as you ship.
Release, a named snapshot within a group. Each release locks specific revisions (branches or commits) of each member project, so the compliance picture is reproducible. Every release group has at least one release.
Why use release groups
- Unified reporting: see licenses, vulnerabilities, and quality issues across every project in a release at once, and generate combined reports covering the whole product.
- Shared policy: apply the same licensing, security, and quality policies consistently to every project in the release.
- Reproducible results: pinning exact revisions means the same release always returns the same compliance result, regardless of what's been pushed since.
When to use them
Release groups work well when you ship multiple projects together as a coherent product, want to apply a single compliance policy to an entire service or application layer, or need to demonstrate that a specific release met your compliance requirements at a point in time.
If you have one project or are doing exploratory scanning, a release group adds overhead without benefit. Use projects directly.
Navigating a release group
Once inside a release group, a tab bar gives access to everything for the selected release. Switch releases at any time using the release selector in the header, all tabs except Releases and Settings reflect the currently selected release.
| Tab | What it shows |
|---|---|
| Summary | Project, dependency, and license counts for the selected release, plus quick links to generate reports |
| Projects | The list of projects pinned in the selected release |
| Issues | Licensing, security, and quality issues aggregated across all projects in the release |
| Inventory | The full list of dependencies across all projects in the release |
| Licenses | License breakdown across the release, with an obligations panel |
| Reports | Generate licensing, vulnerability, SBOM, and remediation guidance reports |
| Releases | Create, edit, clone, and delete releases (group-level, not release-specific) |
| Settings | Configure the group title, policies, report defaults, and portal visibility |