moves permission fix before crane digest

Author: timbastin

.github/workflows/build-image.yml

@@ -99,6 +99,11 @@ jobs:
       env:
         IMAGE_DESTINATION_PATH: ${{ inputs.image-destination-path }}
 
+    - name: Fix workspace permissions
+      run: |
+        sudo chown -R $(id -u):$(id -g) $GITHUB_WORKSPACE || true
+      continue-on-error: true
+
     - name: Use crane to get the digest
       run: |
         docker run --rm \
@@ -109,11 +114,6 @@ jobs:
       env:
         IMAGE_DESTINATION_PATH: ${{ inputs.image-destination-path }}
 
-    - name: Fix workspace permissions
-      run: |
-        sudo chown -R $(id -u):$(id -g) $GITHUB_WORKSPACE || true
-      continue-on-error: true
-
     # Uploading the built Docker image as an artifact
     - name: Upload artifact
       uses: actions/upload-artifact@v4
@@ -227,6 +227,11 @@ jobs:
         args: devguard-scanner intoto stop --step=build --products=image-digest.txt --products=image-tag.txt --token=${{ secrets.devguard-token }} --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --supplyChainId=${{ github.sha }} --generateSlsaProvenance --defaultRef=${{ github.event.repository.default_branch }} --isTag=${{ github.ref_type == 'tag' }} --ref=${{ github.ref_name }}
       continue-on-error: true
 
+    - name: Fix workspace permissions (after provenance)
+      run: |
+        sudo chown -R $(id -u):$(id -g) $GITHUB_WORKSPACE || true
+      continue-on-error: true
+
     - name: Upload SLSA Provenance
       uses: actions/upload-artifact@v4
       with: