release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    name: Release
    runs-on: self-hosted
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build ollama-nitro image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: ollama-nitro:latest

      - name: Build EIF image
        run: |
          nitro-cli build-enclave --docker-uri ollama-nitro:latest --output-file tinfoil-enclave-${{ github.ref_name }}.eif

      - name: Create measurements predicate
        run: |
          nitro-cli describe-eif --eif-path tinfoil-enclave-${{ github.ref_name }}.eif > tinfoil-enclave-${{ github.ref_name }}-info.json
          jq -r ".Measurements" tinfoil-enclave-${{ github.ref_name }}-info.json > predicate.json

      - name: Attest
        uses: actions/attest@v1
        id: attest
        with:
          subject-path: tinfoil-enclave-${{ github.ref_name }}.eif
          predicate-type: https://tinfoil.sh/predicate/nitro-enclave-measurements/v1
          predicate-path: predicate.json

      - name: Generate release notes
        id: generate-release-notes
        run: |
          RELEASE_NOTES=$(cat << EOF
          Measurements:
          \`\`\`
          $(cat predicate.json)
          \`\`\`
          Log: https://search.sigstore.dev?logIndex=$(jq -r ".verificationMaterial.tlogEntries[0].logIndex" ${{ steps.attest.outputs.bundle-path }})
          EOF
          )
          echo "release-notes<<EOF" >> "$GITHUB_OUTPUT"
          echo "${RELEASE_NOTES}" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            tinfoil-enclave-${{ github.ref_name }}.eif
            tinfoil-enclave-${{ github.ref_name }}-info.json
          body: ${{ steps.generate-release-notes.outputs.release-notes }}