Update github actions

- Build on the Oxide Colo runner
- Package and attest

Author: labbott

.github/workflows/build.yml

@@ -33,3 +33,5 @@ jobs:
         key: ${{ runner.os }}-rustup-${{ hashFiles('rust-toolchain.toml') }}
     - name: Build
       run: cargo build
+    - name: Package
+      run: cargo xtask package --out file.zip --board lpc55xpresso

.github/workflows/release-build.yml

@@ -12,8 +12,11 @@ env:
 
 jobs:
   release-build:
-    runs-on: ubuntu-latest
-
+    runs-on: oxide-colo-builder-hubris
+    permissions:
+      id-token: write
+      attestations: write
+      contents: write
     strategy:
       matrix:
         board:
@@ -32,8 +35,12 @@ jobs:
         sudo apt-get update && sudo apt-get install binutils-arm-none-eabi
 
     - name: Build
+      id: build
       run: |
-        cargo build --release --no-default-features --features target-board-${{ matrix.board }}
+        PACKAGE_NAME=bootleby-${{ matrix.board }}
+        echo "package_name=${PACKAGE_NAME}" >> "${GITHUB_OUTPUT}"
+        # This implicitly calls `cargo build --release`
+        cargo xtask package --board ${{ matrix.board }} --out ${PACKAGE_NAME}.zip
 
     - name: Package artifacts
       id: package
@@ -57,13 +64,20 @@ jobs:
         # Make some info available for later steps
         echo "build_name=${BUILD_NAME}" >> "${GITHUB_OUTPUT}"
 
+
+    - name: Attestation
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: ${{ steps.build.outputs.package_name }}.zip
+
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.package.outputs.build_name }}
         path: |
           ${{ steps.package.outputs.build_name }}.elf
           ${{ steps.package.outputs.build_name }}.bin
+          ${{ steps.build.outputs.package_name }}.zip
         
     - name: Create release if tagged
       if: startsWith(github.ref, 'refs/tags/')
@@ -86,3 +100,4 @@ jobs:
         files: |
           ${{ steps.package.outputs.build_name}}.elf
           ${{ steps.package.outputs.build_name}}.bin
+          ${{ steps.build.outputs.package_name }}.zip