chore: update main workflow, add release workflow #4

	name: Release

	on:
	push:
	tags:
	- '*'

	jobs:
	build-artifacts:
	runs-on: ubuntu-latest
	container:
	image: ghcr.io/vanilla-os/pico:main
	volumes:
	- /proc:/proc
	- /:/run/host
	options: --privileged -it
	permissions:
	contents: read

	steps:
	- uses: actions/checkout@v4

	- name: De-bloat stock image
	run: \|
	rm -r /run/host/usr/share/dotnet
	rm -r /run/host${{ runner.tool_cache }}

	- name: Install needed packages
	run: apt update && apt install dpkg-dev build-essential debhelper -y

	- name: Build debian package
	run: \|
	dpkg-buildpackage --no-sign
	mv ../*.deb ../base-files.deb

	- name: Calculate and Save Checksums
	run: \|
	sha256sum /__w/base-files/base-files.deb >> checksums.txt

	- uses: actions/upload-artifact@v4
	with:
	name: base-files
	path: \|
	checksums.txt
	/__w/base-files/base-files.deb

	release:
	runs-on: ubuntu-latest
	needs: build-artifacts
	permissions:
	contents: write # to create and upload assets to releases
	attestations: write # to upload assets attestation for build provenance
	id-token: write # grant additional permission to attestation action to mint the OIDC token permission

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Download Artifact
	uses: actions/download-artifact@v4
	with:
	name: base-files

	- name: Create Release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: gh release create "${{ github.ref_name }}" --generate-notes *.deb base-files/checksums.txt

	- name: Attest Release Files
	id: attest
	uses: actions/attest-build-provenance@v1
	with:
	subject-path: '.deb, base-files/.txt'

Provide feedback