Still fixing

Author: Val Brodsky

.github/actions/provenance/action.yml

@@ -0,0 +1,17 @@
+name: Labelbox Python SDK Provenance Generation
+
+inputs:
+  subjects:
+    required: true
+    type: string   
+runs:
+  using: "composite"
+  permissions:
+    actions: read
+    contents: write
+    id-token: write # Needed to access the workflow's OIDC identity.    
+  uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+  with:
+    base64-subjects: "${{ inputs.subjects }}"
+    upload-assets: true
+    upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow  

.github/workflows/lbox-publish.yml

@@ -71,7 +71,7 @@ jobs:
       - name: "Generate hashes"
         id: hash
         run: |
-          cd dist && echo "hashes-${{matrix.package}}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
+          cd dist && echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
       - uses: actions/upload-artifact@v4
         with:
           name: build-${{ matrix.package }}
@@ -93,13 +93,13 @@ jobs:
         run: |
           HASH_VAR="hashes-${{ matrix.package }}"
           echo "HASH_VAR=$HASH_VAR" >> $GITHUB_ENV
-          echo "Using hash: ${{ env.HASH_VAR }}"
-      - uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+          echo "Using hash: ${{ env.HASH_VAR }}" 
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}     
+      - uses: ./.github/actions/provenance
         with:
-          private-repository: true
-          base64-subjects: "${{ env.HASH_VAR }}"
-          upload-assets: true
-          upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow  
+          subject: ${{ env.HASH_VAR }}
 
   test-build:
     needs: ['path-filter']