From 0c1b27784031a808e41e61dfa996957950d671dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guillermo=20C=C3=A9spedes=20Tab=C3=A1rez?=
 <1295883+dertin@users.noreply.github.com>
Date: Wed, 5 Aug 2026 01:46:45 -0300
Subject: [PATCH] Fix release artifact checksum selection

Exclude unrelated workflow artifacts before checksum, attestation, and GitHub Release publication.
---
 .github/workflows/release.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b377d60..0c06d6c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -276,7 +276,21 @@ jobs:
         run: |
           set -euo pipefail
           cd release-assets
-          sha256sum * > SHA256SUMS
+          shopt -s nullglob
+          archives=(*.tgz *.zip)
+          sboms=(*.cdx.json)
+          if [ "${#archives[@]}" -ne 5 ] || [ "${#sboms[@]}" -ne 1 ]; then
+            printf 'expected five archives and one SBOM; found %s archives and %s SBOMs\n' \
+              "${#archives[@]}" "${#sboms[@]}" >&2
+            exit 1
+          fi
+          sha256sum "${archives[@]}" "${sboms[@]}" > SHA256SUMS
+          find . -mindepth 1 -maxdepth 1 \
+            ! -name '*.tgz' \
+            ! -name '*.zip' \
+            ! -name '*.cdx.json' \
+            ! -name 'SHA256SUMS' \
+            -exec rm -rf -- {} +
 
       - name: Generate artifact attestations
         uses: actions/attest@v4