Update attest.yml

Author: Hubtrick-Git

.github/workflows/attest.yml

@@ -28,6 +28,11 @@ jobs:
   attest:
     runs-on: ubuntu-latest
     steps:
+    - name: slugify all the variables for the building of the url
+      uses: docker://ghcr.io/l3montree-dev/devguard-scanner:main-latest
+      with:
+        args: sh -c "devguard-scanner slug ${{ github.ref_name }} > ref-slug"
+    - name: Get VeX
     - name: Download image-digest artifact (can be created by build-image)
       uses: actions/download-artifact@v4
       with:
@@ -42,15 +47,15 @@ jobs:
     - name: Get SBOM
       uses: docker://ghcr.io/l3montree-dev/devguard-scanner:main-latest
       with:
-        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ github.ref_name }}/sbom.json --token='${{ secrets.devguard-token }}' > sbom.json"
+        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ ref-slug }}/sbom.json --token='${{ secrets.devguard-token }}' > sbom.json"
     - name: Get VeX
       uses: docker://ghcr.io/l3montree-dev/devguard-scanner:main-latest
       with:
-        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ github.ref_name }}/vex.json --token='${{ secrets.devguard-token }}' > vex.json"
+        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ ref-slug }}/vex.json --token='${{ secrets.devguard-token }}' > vex.json"
     - name: Get SAST-Results
       uses: docker://ghcr.io/l3montree-dev/devguard-scanner:main-latest
       with:
-        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ github.ref_name }}/sarif.json --token='${{ secrets.devguard-token }}' > sarif.json"
+        args: sh -c "devguard-scanner get ${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/${{ ref-slug }}/sarif.json --token='${{ secrets.devguard-token }}' > sarif.json"
     - name: Attest SBOM
       uses: docker://ghcr.io/l3montree-dev/devguard-scanner:main-latest
       with:
@@ -100,4 +105,4 @@ jobs:
             else
               devguard-scanner attest build.provenance.json --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --predicateType='https://slsa.dev/provenance/v1' --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }}
             fi
-          "
+          "