From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 9 Jan 2024 11:40:29 +0000 (+0100)
Subject: build-packages: Fix the handling of provenance artifacts
X-Git-Tag: auth-4.9.0-alpha1~6^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F13688%2Fhead;p=thirdparty%2Fpdns.git

build-packages: Fix the handling of provenance artifacts

The current version of the SLSA framework uses upload-artifact v3
which is not compatible with download-artifact v4 (don't ask me).
---

diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index e593ea7706..13ab3a36b3 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -187,12 +187,12 @@ jobs:
     steps:
       - name: Download source tarball provenance for ${{ inputs.product }} (${{ inputs.ref }})
         id: download-src-provenance
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v3 # we need v3, see https://github.com/slsa-framework/slsa-github-generator/pull/3067/files
         with:
           name: "${{ inputs.product }}-${{ needs.build.outputs.version }}-src.intoto.jsonl"
       - name: Download provenance for ${{ inputs.product }} (${{ inputs.ref }}) for ${{ matrix.os }}
         id: download-provenance
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v3 # we need v3, see https://github.com/slsa-framework/slsa-github-generator/pull/3067/files
         with:
           name: "${{ inputs.product }}-${{ needs.build.outputs.version }}-${{ matrix.os}}.intoto.jsonl"
       - name: Upload provenance artifacts to downloads.powerdns.com