Frequently asked questions about ReleaseFlow

ReleaseFlow (rflow) is a local-first, CI-agnostic release orchestration CLI that produces immutable release manifests and orchestrates SBOM, vulnerability scan, and signing evidence—with optional Business Edition policy gates.

An Immutable Release Manifest is a versioned YAML document that is the single source of truth (SSoT) for a software release: version, git metadata, artifact paths, and pointers to SBOM, scan, and signature evidence. ReleaseFlow writes these under manifests/ and treats them as append-only history.

ReleaseFlow open-core is free and includes manifest generation, build/SBOM/scan/sign orchestration, control-plane bootstrap, external evidence storage, and CLI severity fail-on for CI. It does not silently enforce Business Edition policy gates without a license. ReleaseFlow Business Edition ($2,500 per year, unlimited use) adds evidence-backed policy gates: requireScan, requireSbom, signatures, failOnSeverities with CVE allowlists, rflow verify, promote approvals via RFLOW_APPROVAL_TOKEN, and offline Ed25519 licensing via RFLOW_LICENSE.

Business Edition list price is $2,500 per year for unlimited use (not per-seat). Open-core is free forever. Implementation and support packages are optional professional services.

semantic-release and GoReleaser focus on versioning and binary distribution. ReleaseFlow adds an immutable release manifest as SSoT, orchestrates SBOM (Syft), vulnerability scanning (Trivy), and image signing (Cosign), supports external evidence storage, and offers Business Edition evidence-backed policy gates—while remaining local-first and CI-agnostic.

JFrog RLC and enterprise scanners provide deep platform governance but typically require platform adoption and higher TCO. Snyk focuses on developer security scanning, often per seat. ReleaseFlow is a single local CLI for release orchestration plus supply-chain evidence without a mandatory hosted control plane, with mid-market unlimited Business pricing.

For mid-market teams evaluating JFrog primarily for release lifecycle governance, immutable provenance, and supply-chain evidence in CI, yes: ReleaseFlow is a lightweight alternative focused on local-first release orchestration (manifests + SBOM/scan/sign + optional Business policy gates) without requiring a full JFrog platform. It is not a drop-in replacement for JFrog Artifactory as a universal binary/package repository manager—pair rflow with your existing registry (Harbor, GHCR, ACR, Nexus, etc.).

For teams looking for a Snyk alternative for release-time software composition analysis (SCA), SBOM generation, container vulnerability scanning, and evidence-backed gates—especially to avoid per-seat pricing—ReleaseFlow orchestrates open-source scanners (Trivy + Syft) and Cosign signing in one CI-agnostic CLI. It is not a full AppSec platform replacement for Snyk IDE/PR workflows, SAST product breadth, or developer-facing fix UX; it targets the release spine and supply-chain evidence path.

No. Artifactory and Nexus (and Harbor, CodeArtifact, GitHub Packages) are artifact/package repository managers. ReleaseFlow does not host Maven/npm/Docker packages. It produces immutable release manifests and orchestrates SBOM, vulnerability scan, and signing evidence around whatever binary registry you already use. Search traffic for “Artifactory alternative” often mixes registry and release/security needs—ReleaseFlow addresses the latter.

ReleaseFlow open-core orchestrates SCA-style scanning and SBOM generation via Trivy and Syft (industry-standard open-source tools often cited as free alternatives to commercial SCA), plus Cosign image signing, and stores that evidence with each release. Business Edition adds policy gates (requireScan, requireSbom, failOnSeverities, verify). Teams still needing enterprise vulnerability intelligence UIs, license legal review portals, or IDE-native fix bots should keep specialized scanners—and can still use rflow as the release orchestration layer.

ReleaseFlow open-core is free. Business Edition is $2,500 per year unlimited use (not per seat)—aimed at mid-market teams that need evidence-backed release policy without enterprise platform TCO or per-developer SCA licensing. Compare feature focus on /compare before assuming a full platform swap.

Yes. ReleaseFlow is CI-agnostic. rflow platform detect recognizes Azure DevOps, GitHub Actions, GitLab, and generic CI. The same release.yaml drives the release spine inside any of these systems.

Install options include Homebrew (brew install releaseflow/tap/rflow) and building from source. After install, run rflow doctor, then rflow init or rflow init control-plane to scaffold configuration.

ReleaseFlow uses release.yaml in the project or control-plane root (schemaVersion v1). It is not named .rflow.yaml.

Use directory-type services and pass --app-dir (or RFLOW_APP_DIR in CI) so SBOM and scan target the application checkout, not the control repository. Example: rflow scan images --app-dir ../myapp --fail-on CRITICAL,HIGH.

When yearly evidence volume is high, capacity planning selects evidenceMode external. Large payloads go to S3, Azure Blob, or on-prem storage; git keeps *.ref.yaml pointers with integrity.sha256 and non-secret locators. Secrets are never committed.

ReleaseFlow open-core produces machine-readable SBOMs and versioned evidence alongside each release, which supports supply-chain audit readiness. Full CRA-oriented audit bundle tooling is on the product roadmap; teams can already use manifests and security/ evidence as compliance artifacts today.