From 03729a1f1fda3eba2b7634879d64203c7e127e92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Mon, 5 Oct 2026 11:42:40 -0400
Subject: [PATCH] ci: download release assets into a temp dir, not the assets
 folder

---
 .github/workflows/package.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index fd47fa9f2..d42f3a906 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -90,10 +90,10 @@ jobs:
         run: |
           set -euo pipefail
           VERSION=$(node -p "require('./package.json').version")
-          mkdir assets
-          gh release download "v${VERSION}" --dir assets \
+          dir=$(mktemp -d)
+          gh release download "v${VERSION}" --dir "$dir" \
             -p '*.dmg' -p '*.exe' -p '*.deb' -p '*.rpm' -p '*.AppImage'
-          ( cd assets && sha256sum * ) | LC_ALL=C sort -k 2 > SHA256SUMS
+          ( cd "$dir" && sha256sum * ) | LC_ALL=C sort -k 2 > SHA256SUMS
           cat SHA256SUMS
           ./.github/scripts/verify-manifest.sh SHA256SUMS
           gh release upload "v${VERSION}" SHA256SUMS --clobber