fix(github): Be explicity about artifact paths to attest for

Work-around [1] and only attest the main artifacts, not the signature files. [1]: actions/attest-build-provenance#133 Signed-off-by: Sebastian Schuberth <[email protected]>
oss-review-toolkit · Jun 27, 2024 · fd68f74 · fd68f74
1 parent f9e7f72
commit fd68f74
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -59,5 +59,7 @@ jobs:
         uses: actions/attest-build-provenance@v1
         with:
           subject-path: |
-            ./cli/build/distributions/ort-$ORT_VERSION.{tgz,zip}*
-            ./helper-cli/build/distributions/orth-$ORT_VERSION.{tgz,zip}*
+            ./cli/build/distributions/ort-$ORT_VERSION.tgz
+            ./cli/build/distributions/ort-$ORT_VERSION.zip
+            ./helper-cli/build/distributions/orth-$ORT_VERSION.tgz
+            ./helper-cli/build/distributions/orth-$ORT_VERSION.zip