diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 80499b054..0d399bfbb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,14 +55,15 @@ jobs: - name: Download assets env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}" run: | set -euo pipefail gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz" - gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "multiple.intoto.jsonl" + gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p $PROVENANCE - name: Verify assets env: CHECKSUMS: ${{ needs.goreleaser.outputs.hashes }} - PROVENANCE: "${{ needs.provenance.outputs.attestation-name }}" + PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}" run: | set -euo pipefail checksums=$(echo "$CHECKSUMS" | base64 -d)