chore: update repo-platform template to build@dbb1eda539ab

.github/.copier-answers.yml

@@ -1,6 +1,6 @@
 # This file is managed by Vivswan/repo-platform.
 # Copier uses it to track the template source and version - do not delete.
-_commit: 79b961b
+_commit: dbb1eda
 _src_path: gh:Vivswan/repo-platform
 copyright_holder: Vivswan Shah (https://github.com/Vivswan)
 description: 'GitHub Action applying declarative repository settings: rulesets, labels,

.github/repo-platform-manifest.json

@@ -4,7 +4,7 @@
     ".bun-version": {"class": "managed", "hash": "78b591400c56b7b67b8cb3b2b8a8e65e9093897f02ce0878e6b5405c68620fa7"},
     ".editorconfig": {"class": "split", "grammar": "managed-region", "begin": "# BEGIN REPO-PLATFORM MANAGED", "end": "# END REPO-PLATFORM MANAGED", "hash": "98775644ebdeb9cde0670616220143adf668c1201cf4160f8f408a8e77a62cc1"},
     ".gitattributes": {"class": "split", "grammar": "managed-region", "begin": "# BEGIN REPO-PLATFORM MANAGED", "end": "# END REPO-PLATFORM MANAGED", "hash": "92725e53e7a53a282e02b075a56e2bf59424be384c53d7bf7d1116f1f8a9141e"},
-    ".github/.copier-answers.yml": {"class": "managed", "hash": "6c73ff916c58d4094640e03ce021485dfbe60aa6934f12249b7b6ca170efd4b2"},
+    ".github/.copier-answers.yml": {"class": "managed", "hash": "a1bcc9bbaa7f71fa42ad60ee9b681c018b9c07f16b3cf4abafaed75ec7f23619"},
     ".github/CODEOWNERS": {"class": "split", "grammar": "managed-region", "begin": "# BEGIN REPO-PLATFORM MANAGED", "end": "# END REPO-PLATFORM MANAGED", "hash": "331b950ff34c80af626de9342204f19c460a6fa0ae94a646d6618be66934b302"},
     ".github/ISSUE_TEMPLATE/bug_report.yml": {"class": "starter"},
     ".github/ISSUE_TEMPLATE/config.yml": {"class": "starter"},
@@ -13,7 +13,7 @@
     ".github/agents.md": {"class": "managed", "hash": "79909577a70fc4971a7fcfd3cbec6a1af7182ca2dadc87f2979dce5e28f93ca0"},
     ".github/copilot-instructions.md": {"class": "managed", "hash": "79909577a70fc4971a7fcfd3cbec6a1af7182ca2dadc87f2979dce5e28f93ca0"},
     ".github/dependabot.yml": {"class": "managed", "hash": "2f870f0d6d13aa2602c62f0efc26feeaf63e3abc415d0bb7c087235d6e20d867"},
-    ".github/repo-platform-manifest.json": {"class": "managed", "hash": null, "commit": "79b961b"},
+    ".github/repo-platform-manifest.json": {"class": "managed", "hash": null, "commit": "dbb1eda"},
     ".github/workflows/auto-assign.yml": {"class": "managed", "hash": "eac4af90122720aa8c490cbba8656a0ae248bcb1485dc9844e5f6c6e730de5de"},
     ".github/workflows/auto-format.yml": {"class": "starter"},
     ".github/workflows/checks.yml": {"class": "starter"},
@@ -23,7 +23,7 @@
     ".github/workflows/nightly-fuzz.yml": {"class": "starter"},
     ".github/workflows/nightly.yml": {"class": "starter"},
     ".github/workflows/pr-title.yml": {"class": "managed", "hash": "aed03ff29ddf3f8f46d1b6d1d82c0d70a5c23c4a52b001ea12264e43f6461ac8"},
-    ".github/workflows/release.yml": {"class": "managed", "hash": "407149af309ceba3fa94a3bbc99b5dd3026366c5f4a0c6f4f93e08ee6e1d66a0"},
+    ".github/workflows/release.yml": {"class": "managed", "hash": "caf6e23c2fb88f726cdcdfb8424fafe02feabccc3e658eb80ce0853dd8143fc2"},
     ".github/workflows/update-release-pr.yml": {"class": "starter"},
     ".github/workflows/update-release.yml": {"class": "starter"},
     ".gitignore": {"class": "split", "grammar": "managed-region", "begin": "# BEGIN REPO-PLATFORM MANAGED", "end": "# END REPO-PLATFORM MANAGED", "hash": "62cf71e8ed57fafc3fd38fef5a38c95b8f5cad32a60a95ec31802f8664eee78b"},

.github/workflows/release.yml

@@ -115,19 +115,26 @@ jobs:
     env:
       GH_REPO: ${{ github.repository }}
       TAG: ${{ needs.release-please.outputs.tag_name }}
+      # One Sigstore bundle covering every asset, under the attest action's
+      # own file name.
+      BUNDLE_NAME: attestation.json
     steps:
-      # A stale attestation.jsonl from a prior attempt is deleted from the
-      # RELEASE, so no later skip path can publish it.
+      # A stale bundle from a prior attempt is deleted from the RELEASE, so
+      # no later skip path can publish it.
       - name: Inspect the draft release's assets
         id: assets
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           names="$(gh release view "$TAG" --json assets --jq '.assets[].name')"
-          if grep -qxF attestation.jsonl <<< "$names"; then
-            gh release delete-asset "$TAG" attestation.jsonl --yes
-          fi
-          if [ -n "$(grep -vxF attestation.jsonl <<< "$names" || true)" ]; then
+          present=false
+          while IFS= read -r name; do
+            case "$name" in
+              "$BUNDLE_NAME") gh release delete-asset "$TAG" "$name" --yes ;;
+              ?*) present=true ;;
+            esac
+          done <<< "$names"
+          if [ "$present" = true ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"
           else
             echo "::notice::the release has no assets; nothing to attest"
@@ -149,15 +156,15 @@ jobs:
         with:
           subject-path: assets/*
       # bundle-path is empty when download/attest skipped: a no-asset or
-      # non-public release publishes without an attestation.jsonl.
+      # non-public release publishes without a bundle.
       - name: Attach the attestation bundle to the draft
         if: steps.attest.outputs.bundle-path != ''
         env:
           GH_TOKEN: ${{ github.token }}
           BUNDLE: ${{ steps.attest.outputs.bundle-path }}
         run: |
-          cp "$BUNDLE" attestation.jsonl
-          gh release upload "$TAG" attestation.jsonl --clobber
+          cp "$BUNDLE" "$BUNDLE_NAME"
+          gh release upload "$TAG" "$BUNDLE_NAME" --clobber
       - name: Publish the GitHub release
         env:
           GH_TOKEN: ${{ secrets.REPO_PLATFORM_TOKEN || github.token }}