release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build nginx-nitro image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: ollama-nitro:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build eif-builder image
        uses: docker/build-push-action@v5
        with:
          context: eif-builder
          push: false
          load: true
          tags: eif-builder:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build EIF image
        run: |
          docker run \
            --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v $(pwd):/output \
            -e DOCKER_IMAGE=ollama-nitro:latest \
            -e EIF_FILE=tinfoil-enclave-${{ github.ref_name }}.eif \
            -e INFO_FILE=tinfoil-enclave-${{ github.ref_name }}-info.json \
            eif-builder:latest

      - name: Create measurements predicate
        run: jq -r ".Measurements" tinfoil-enclave-${{ github.ref_name }}-info.json > predicate.json

      - name: Attest
        uses: actions/attest@v1
        id: attest
        with:
          subject-path: tinfoil-enclave-${{ github.ref_name }}.eif
          predicate-type: https://tinfoil.sh/predicate/nitro-enclave-measurements/v1
          predicate-path: predicate.json

      - name: Generate release notes
        id: generate-release-notes
        run: |
          RELEASE_NOTES=$(cat << EOF
          Measurements:
          \`\`\`
          $(cat predicate.json)
          \`\`\`
          Log: https://search.sigstore.dev?logIndex=$(jq -r ".verificationMaterial.tlogEntries[0].logIndex" ${{ steps.attest.outputs.bundle-path }})
          EOF
          )
          echo "release-notes<<EOF" >> "$GITHUB_OUTPUT"
          echo "${RELEASE_NOTES}" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            tinfoil-enclave-${{ github.ref_name }}.eif
            tinfoil-enclave-${{ github.ref_name }}-info.json
          body: ${{ steps.generate-release-notes.outputs.release-notes }}