reorder provenance before release, set upload-assets: false so release job collects attestation

.github/workflows/release.yml

@@ -73,7 +73,7 @@ jobs:
         with:
           path: .
           format: cyclonedx-json
-          output-file: builds/notalterra-${GITHUB_REF_NAME}-sbom.cdx.json
+          output-file: builds/notalterra-sbom.cdx.json
       - name: Generate hashes
         id: hash
         run: |
@@ -87,14 +87,25 @@ jobs:
           name: release-binaries
           path: builds/
 
-  release:
+  provenance:
     needs: build
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+      contents: write
+      actions: read
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"
+      upload-assets: false
+
+  release:
+    needs: [build, provenance]
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
       contents: write
       id-token: write
-      attestations: write
     steps:
       - uses: actions/checkout@v4
       - name: Download all artifacts
@@ -107,15 +118,3 @@ jobs:
           files: builds/*/*
           body_path: _release.md
           draft: true
-
-  provenance:
-    needs: [build, release]
-    if: startsWith(github.ref, 'refs/tags/v')
-    permissions:
-      id-token: write
-      contents: write
-      actions: read
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.build.outputs.hashes }}"
-      upload-assets: true