Release #7

	name: Release

	on:
	workflow_dispatch:
	inputs:
	release_tag:
	description: 'Release tag (e.g. v1.0.0)'
	required: false
	default: 'latest'

	permissions:
	id-token: write
	contents: read
	attestations: write
	packages: write

	env:
	REGISTRY: ghcr.io
	USER: githubsecuritylab
	IMAGE_NAME: seclab-taskflow-agent

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'

	- name: Create release
	id: docker_build
	run: \|
	echo ${{ secrets.PACKAGES_TOKEN }} \| docker login ghcr.io -u GitHubSecurityLab --password-stdin
	python release_tools/publish_docker.py release.txt main.py ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }} ${{ github.event.inputs.release_tag }}
	DIGEST=$(cat /tmp/digest.txt)
	echo "digest=$DIGEST" >> $GITHUB_OUTPUT

	- name: Generate artifact attestation
	uses: actions/attest-build-provenance@v3
	with:
	subject-name: ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }}
	subject-digest: '${{ steps.docker_build.outputs.digest }}'
	push-to-registry: true

	- name: Verify
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh attestation verify oci://ghcr.io/${{ env.USER }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.release_tag }} -R ${{ github.repository }}

Provide feedback