cleanup: update files; feat: add vib module

Signed-off-by: K.B.Dharun Krishna <[email protected]>

.github/dependabot.yml

@@ -3,4 +3,4 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "monthly"
+      interval: "weekly"

.github/workflows/release.yml

@@ -0,0 +1,54 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+env:
+    REGISTRY_USER: ${{ github.actor }}
+    REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  verify-image:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Verify Base Image Integrity
+      run:
+        gh attestation verify oci://ghcr.io/vanilla-os/pico:main --owner Vanilla-OS
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+  release:
+    runs-on: ubuntu-latest
+    needs: verify-image
+    permissions:
+      contents: write # Allow actions to create release
+      attestations: write # To create and write attestations
+      id-token: write # Additional permissions for the persistence of the attestations
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: vanilla-os/[email protected]
+
+      - uses: actions/upload-artifact@v4
+        with:
+            name: Containerfile
+            path: Containerfile
+
+      - name: Create Release
+        env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "${{ github.ref_name }}" --generate-notes Containerfile
+
+      - name: Attest Release Files
+        id: attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: 'Containerfile'

.gitignore

@@ -0,0 +1,4 @@
+Containerfile
+downloads/
+plugins/
+sources/

README.md

@@ -16,7 +16,7 @@ podman image build -t vanillaos/dev .
 
 ## Verify Image Build Provenance Attestation
 
-All the image builds/pushes are attested for build provenance and integrity using the [attest-build-provenance`](https://github.com/actions/attest-build-provenance) action. The attestations can be verified [here](https://github.com/Vanilla-OS/dev-image/attestations) or by having the latest version of [GitHub CLI](https://github.com/cli/cli/releases/latest) installed in your system. Then, execute the following command:
+All the image builds/pushes are attested for build provenance and integrity using the [attest-build-provenance](https://github.com/actions/attest-build-provenance) action. The attestations can be verified [here](https://github.com/Vanilla-OS/dev-image/attestations) or by having the latest version of [GitHub CLI](https://github.com/cli/cli/releases/latest) installed in your system. Then, execute the following command:
 
 ```sh
 gh attestation verify oci://ghcr.io/vanilla-os/dev:main --owner Vanilla-OS

modules/101-abroot-deps.yml

@@ -5,5 +5,5 @@ source:
   - libbtrfs-dev
   - libdevmapper-dev
   - libgpgme-dev
-  - pkg-config build-essential
+  - pkg-config
   - libdpkg-dev

modules/20-build-tools.yml

@@ -3,7 +3,6 @@ type: apt
 source:
   packages:
   - meson
-  - build-essential
   - ninja-build
   - cmake
   - clang

modules/200-vib.yml

@@ -0,0 +1,10 @@
+name: vib
+type: shell
+source:
+  type: file
+  url: https://github.com/Vanilla-OS/Vib/releases/download/v0.7.4/vib
+  checksum: 8f95d449cacedcac7bb38f7cfd422689fa5a800c10580e663dea7384473c767f
+commands:
+  - mkdir -p /usr/bin
+  - cp /sources/vib/vib /usr/bin/vib
+  - chmod +x /usr/bin/vib

recipe.yml

@@ -24,12 +24,17 @@ stages:
       - modules/30-gtk.yml
       - modules/40-rust.yml
       - modules/100-apx-gui-deps.yml
+      - modules/101-abroot-deps.yml
+      - modules/200-vib.yml
 
   - name: host-spawn
     type: shell
+    source:
+      type: file
+      url: https://github.com/1player/host-spawn/releases/download/v1.6.0/host-spawn-x86_64
+      checksum: 75159f0d3924a0bd6d230c6414d19ad44609b5a16671db6624681c910f9bb4ff
     commands:
-      - wget https://github.com/1player/host-spawn/releases/download/v1.6.0/host-spawn-x86_64
-      - mv host-spawn-x86_64 /usr/bin/host-spawn
+      - cp /sources/host-spawn/host-spawn /usr/bin/host-spawn
       - chmod +x /usr/bin/host-spawn
 
   - name: cleanup