Update the lbox publish workflow to publish lbox packages dynamically

Author: Val Brodsky

.github/workflows/lbox-publish.yml

@@ -41,16 +41,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     needs: ['path-filter', 'test-build']
-    outputs:
-      hashes: ${{ steps.hash.outputs.hashes_lbox-clients }}
+    permissions:
+      actions: read
+      contents: write
+      id-token: write # Needed to access the workflow's OIDC identity.
     strategy:
       fail-fast: false
       matrix: 
         include: ${{ fromJSON(needs.path-filter.outputs.package-matrix) }}
     steps:
       - uses: actions/checkout@v4
         with:
-          # ref: ${{ inputs.tag }}
           ref: ${{ inputs.tag }}
       - name: Install the latest version of rye
         uses: eifinger/setup-rye@v2
@@ -68,24 +69,20 @@ jobs:
       - name: "Generate hashes"
         id: hash
         run: |
-          cd dist && echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
+          cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
           echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)"
       - uses: actions/upload-artifact@v4
         with:
           name: build-${{ matrix.package }}
-          path: ./dist          
-  provenance_python:
-    needs: [build]
-    permissions:
-      actions: read
-      contents: write
-      id-token: write # Needed to access the workflow's OIDC identity.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
-    with:
-      base64-subjects: "${{ needs.build.outputs.hashes }}"
-      upload-assets: true
-      upload-tag-name: ${{ inputs.tag }} # Tag from the initiation of the workflow
-      provenance-name: lbox-clients.intoto.jsonl
+          path: ./dist
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+      - uses: ./.github/actions/provenance
+        with:
+          subjects: "${{ steps.hash.outputs.hashes }}"
+          tag: ${{ inputs.tag }}
+          provenance-name: ${{ matrix.package }}.intoto.jsonl
 
   test-build:
     needs: ['path-filter']