chore: fix more issues

Author: rjaegers

.github/workflows/release-build.yml

@@ -35,50 +35,56 @@ jobs:
       - uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Amend release description
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
         run: |
-          CURRENT_NOTES=$(gh release view ${{ github.ref_name }} --json body -q '.body')
+          set -Eeuo pipefail
+          CURRENT_NOTES=$(gh release view "${REF_NAME}" --json body -q '.body')
           HEADER=$(echo "$CURRENT_NOTES" | awk '/^## / {print; exit}')
           TEMPLATE=$(cat "$GITHUB_WORKSPACE/.github/RELEASE_TEMPLATE.md")
           BODY=$(echo "$CURRENT_NOTES" | sed "0,/^## /d")
-          gh release edit ${{ github.ref_name }} --notes "${HEADER}${TEMPLATE}${BODY}"
+          gh release edit "${REF_NAME}" --notes "${HEADER}${TEMPLATE}${BODY}"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
   update-release-notes:
     strategy:
       matrix:
         flavor: [cpp, rust]
     runs-on: ubuntu-latest
-    needs: build-push-test
+    needs: [build-push-test, apply-release-notes-template]
     env:
       CONTAINER_FLAVOR: ${{ matrix.flavor }}
       REF_NAME: ${{ github.ref_name }}
       REGISTRY: ghcr.io
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+      - uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
       - name: Inspect manifest and extract digest
         id: inspect-manifest
         run: |
           set -Eeuo pipefail
-          output=$(docker buildx imagetools inspect ${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}:${REF_NAME} --format '{{json .}}')
+          output=$(docker buildx imagetools inspect "${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}:${REF_NAME}" --format '{{json .}}')
           echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
       - name: Upload provenance to release
         run: |
           set -Eeuo pipefail
-          RAW_SHA=${{ steps.inspect-manifest.outputs.digest }}
-          FORMATTED_SHA=${RAW_SHA//:/_}
-          gh attestation verify --repo ${{ github.repository }} oci://${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}@${{ steps.inspect-manifest.outputs.digest }} --format json --jq '.[] | .attestation.bundle.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq . > "${{ github.repository_owner }}-${{ github.event.repository.name }}-${CONTAINER_FLAVOR}_${FORMATTED_SHA}.intoto.jsonl"
-          gh release upload ${REF_NAME} ./*.intoto.jsonl
+          FORMATTED_DIGEST=${DIGEST//:/_}
+          gh attestation verify --repo ${{ github.repository }} "oci://${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}@${DIGEST}" --format json --jq '.[] | .attestation.bundle.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq . > "${{ github.repository_owner }}-${{ github.event.repository.name }}-${CONTAINER_FLAVOR}_${FORMATTED_DIGEST}.intoto.jsonl"
+          gh release upload "${REF_NAME}" ./*.intoto.jsonl
         env:
+          DIGEST: ${{ steps.inspect-manifest.outputs.digest }}
           GH_TOKEN: ${{ github.token }}
       - name: Update package details in release
         run: |
           set -Eeuo pipefail
           UPDATED_NOTES=$(gh release view ${REF_NAME} --json body -q '.body')
-          UPDATED_NOTES=${UPDATED_NOTES//'{{ amp-devcontainer-${CONTAINER_FLAVOR}-version }}'/'${REF_NAME}'}
-          UPDATED_NOTES=${UPDATED_NOTES//'{{ amp-devcontainer-${CONTAINER_FLAVOR}-sha }}'/'${{ steps.inspect-manifest.outputs.digest }}'}
-          gh release edit ${REF_NAME} --notes "${UPDATED_NOTES}"
+          UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-devcontainer-${CONTAINER_FLAVOR}-version }}"/"${REF_NAME}"}
+          UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-devcontainer-${CONTAINER_FLAVOR}-sha }}"/"${DIGEST}"}
+          gh release edit "${REF_NAME}" --notes "${UPDATED_NOTES}"
         env:
+          DIGEST: ${{ steps.inspect-manifest.outputs.digest }}
           GH_TOKEN: ${{ github.token }}