Still fixing

Author: Val Brodsky

.github/actions/provenance/action.yml

@@ -0,0 +1,15 @@
+name: Labelbox Python SDK Provenance Generation
+
+inputs:
+  subjects:
+    required: true
+    type: string   
+runs:
+  using: "composite"
+  steps:
+    - name: upload
+      uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+      with:
+        base64-subjects: "${{ inputs.subjects }}"
+        upload-assets: true
+        upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow  

.github/workflows/lbox-publish.yml

@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: ['path-filter', 'test-build']
     outputs:
-      hashes: ${{ steps.hash.outputs.hashes }}
+      hashes: ${{ steps.hash.outputs.hashes_lbox-clients }}
     strategy:
       fail-fast: false
       matrix: 
@@ -71,36 +71,23 @@ jobs:
       - name: "Generate hashes"
         id: hash
         run: |
-          cd dist && echo "hashes-${{matrix.package}}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
+          cd dist && echo "hashes_${{ matrix.package }}=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT          
       - uses: actions/upload-artifact@v4
         with:
           name: build-${{ matrix.package }}
           path: ./dist          
   provenance_python:
-    needs: [path-filter, build]
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix: 
-        include: ${{ fromJSON(needs.path-filter.outputs.package-matrix) }}    
+    needs: [build]
     permissions:
       actions: read
       contents: write
       id-token: write # Needed to access the workflow's OIDC identity.
-    steps:
-      - name: Use hashes output
-        id: use-hashes
-        run: |
-          HASH_VAR="hashes-${{ matrix.package }}"
-          echo "HASH_VAR=$HASH_VAR" >> $GITHUB_ENV
-          echo "Using hash: ${{ env.HASH_VAR }}"
-      - uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
-        with:
-          private-repository: true
-          base64-subjects: "${{ env.HASH_VAR }}"
-          upload-assets: true
-          upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow  
-        
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes_lbox-clients }}"
+      upload-assets: true
+      upload-tag-name: v.6.0.0 # Tag from the initiation of the workflow
+                
   test-build:
     needs: ['path-filter']
     if: ${{ needs.path-filter.outputs.lbox == 'true' }}