Debug provenance

Author: Val Brodsky

.github/workflows/lbox-publish.yml

@@ -94,11 +94,12 @@ jobs:
           HASH_VAR="hashes-${{ matrix.package }}"
           echo "HASH_VAR=$HASH_VAR" >> $GITHUB_ENV
           echo "Using hash: ${{ env.HASH_VAR }}"
-      - uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+      - uses: ./.github/actions/slsa-framework/slsa-github-generator/.github/workflows/[email protected]
         with:
           base64-subjects: "${{ env.HASH_VAR }}"
           upload-assets: true
-          upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow        
+          upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow  
+          
   test-build:
     needs: ['path-filter']
     if: ${{ needs.path-filter.outputs.lbox == 'true' }}