Good CI #7

	name: Release

	on:
	push:
	tags:
	- 'v*'
	workflow_dispatch:
	inputs:
	branch:
	description: 'Branch to release from'
	required: true
	type: string
	default: 'main'
	version:
	description: 'Version to release (e.g., 1.0.0). If not provided, will be inferred from the latest tag.'
	required: false
	type: string
	draft:
	description: 'Create as draft release'
	required: false
	type: boolean
	default: true

	permissions:
	contents: write # Required by softprops/action-gh-release@v2 to create releases and upload artifacts
	id-token: write # Required by actions/attest@v2 for OIDC authentication with the attestation service
	attestations: write # Required by actions/attest@v2 to create and store attestations

	jobs:
	build:
	name: Build
	uses: ./.github/workflows/build.yaml

	release:
	name: Create Release
	needs: build
	runs-on: ubuntu-latest
	steps:
	- name: Download all artifacts
	uses: actions/download-artifact@v4
	with:
	path: artifacts

	- name: Create Release
	id: create_release
	uses: softprops/action-gh-release@v2
	with:
	name: ${{ github.event.inputs.version \|\| github.ref_name }}
	draft: ${{ github.event.inputs.draft \|\| false }}
	prerelease: false
	generate_release_notes: false
	files: artifacts/*/

	- name: Attest Release
	uses: actions/attest@v2
	with:
	subject-path: artifacts/*/
	predicate-type: 'https://in-toto.io/attestation/release/v0.1'
	predicate: \|
	{
	"version": "${{ github.event.inputs.version \|\| github.ref_name }}",
	"commit": "${{ github.sha }}",
	"branch": "${{ github.event.inputs.branch \|\| github.ref_name }}"
	}

Navigation Menu