From b6821d2aefd4215905e4b5cc043e1fc3af3222d4 Mon Sep 17 00:00:00 2001
From: forkless <forkless@users.noreply.github.com>
Date: Sat, 13 Jun 2026 20:10:48 +0200
Subject: [PATCH] reorder release before provenance in workflow

---
 .github/workflows/release.yml | 36 +++++++++++++----------------------
 1 file changed, 13 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 59c49e5..f17db53 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,20 +85,8 @@ jobs:
           name: release-binaries
           path: builds/
 
-  provenance:
-    needs: build
-    if: startsWith(github.ref, 'refs/tags/v')
-    permissions:
-      id-token: write
-      contents: write
-      actions: read
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.build.outputs.hashes }}"
-      upload-assets: false
-
   release:
-    needs: [build, provenance]
+    needs: build
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
@@ -111,19 +99,21 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: builds/
-      - name: Verify SLSA provenance
-        run: |
-          for file in builds/*/*.tar.gz builds/*/*.zip builds/*/*.cdx.json; do
-            [ -f "$file" ] || continue
-            slsa-verifier verify-artifact \
-              --provenance-path builds/*/*.intoto.jsonl \
-              --source-uri github.com/forkless/NotAlterra \
-              --source-tag "${{ github.ref_name }}" \
-              "$file"
-          done
       - name: Create draft release
         uses: softprops/action-gh-release@v2
         with:
           files: builds/*/*
           body_path: _release.md
           draft: true
+
+  provenance:
+    needs: [build, release]
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+      contents: write
+      actions: read
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"
+      upload-assets: true