Merge pull request #843 from google/verify

ci: Try to fix release signature verification.
google · Apr 23, 2024 · 86f772b · 86f772b
2 parents c2ec5c4 + 7af1b34
commit 86f772b
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -84,10 +84,10 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -euo pipefail
-          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" --archive tar.gz
-          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" --archive zip
-          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE"
+          set -exuo pipefail
+          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --archive tar.gz
+          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --archive zip
+          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --pattern "${PROVENANCE}"
       - name: verify assets
         run: |
           set -euo pipefail