secure download atts

Signed-off-by: Ramon Petgrave <[email protected]>
slsa-framework · Aug 7, 2024 · d693579 · d693579
1 parent ff35a07
commit d693579
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/.github/workflows/debug.generic-generator.yml b/.github/workflows/debug.generic-generator.yml
@@ -127,9 +127,10 @@ jobs:
         with:
           name: artifact2
       - name: Download provenance
-        uses: actions/download-artifact@v4
+        uses: slsa-framework/slsa-github-generator/actions/nodejs/[email protected]
         with:
           name: ${{ needs.provenance2.outputs.provenance-download-name }}
+          sha256: ${{ needs.provenance2.outputs.provenance-download-sha256 }}
       - name: Setup slsa-verifier
         uses: slsa-framework/slsa-verifier/actions/[email protected]
       - name: Verify