CI fixes

Author: labbott

.github/workflows/release-build.yml

@@ -12,8 +12,11 @@ env:
 
 jobs:
   release-build:
-    runs-on: ubuntu-latest
-
+    runs-on: oxide-colo-builder-hubris
+    permissions:
+      id-token: write
+      attestations: write
+      contents: write
     strategy:
       matrix:
         board:
@@ -45,6 +48,7 @@ jobs:
         fi
 
         BUILD_NAME=bootleby-${VERSION}-${{ matrix.board }}
+        PACKAGE_NAME=bootleby-${{ matrix.board }}
 
         cp target/thumbv8m.main-none-eabihf/release/bootleby ${BUILD_NAME}.elf
         arm-none-eabi-objcopy -O binary target/thumbv8m.main-none-eabihf/release/bootleby ${BUILD_NAME}.bin
@@ -56,14 +60,23 @@ jobs:
 
         # Make some info available for later steps
         echo "build_name=${BUILD_NAME}" >> "${GITHUB_OUTPUT}"
+        echo "package_name=${PACKAGE_NAME}" >> "${GITHUB_OUTPUT}"
+
+        cargo xtask package --board ${{ matrix.board }} --out ${PACKAGE_NAME}.zip
+
+    - name: Attestation
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: ${{ steps.package.outputs.package_name }}.zip
 
     - name: Upload artifacts
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.package.outputs.build_name }}
         path: |
           ${{ steps.package.outputs.build_name }}.elf
           ${{ steps.package.outputs.build_name }}.bin
+          ${{ steps.package.outputs.package_name }}.zip
         
     - name: Create release if tagged
       if: startsWith(github.ref, 'refs/tags/')
@@ -86,3 +99,4 @@ jobs:
         files: |
           ${{ steps.package.outputs.build_name}}.elf
           ${{ steps.package.outputs.build_name}}.bin
+          ${{ steps.package.outputs.package_name }}.zip