From 19df2d32136f4ca75131abd003774e4c371adc02 Mon Sep 17 00:00:00 2001
From: Scott Converse <scott@civicsuite.local>
Date: Tue, 5 May 2026 10:13:21 -0600
Subject: [PATCH] [CO-2c-fix] fix release asset paths

---
 .github/workflows/release.yml  |  7 +++++--
 CHANGELOG.md                   |  3 +++
 tests/test_github_workflows.py | 17 +++++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e36e692..cc5ae6b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -129,7 +129,7 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           name: civiccore-dist
-          path: dist/
+          path: release-assets/
 
       - name: Create GitHub release with wheel + sdist
         env:
@@ -153,7 +153,10 @@ jobs:
           sha256sum -c SHA256SUMS.txt
           ```
           EOF
-          gh release create "${{ github.ref_name }}" dist/* \
+          gh release create "${{ github.ref_name }}" \
+            release-assets/dist/* \
+            release-assets/release-attestation.json \
+            release-assets/release-attestation.json.bundle \
             --repo "$GH_REPO" \
             --title "civiccore ${{ github.ref_name }}" \
             --notes-file release-notes.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf16faa..175ed41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -40,6 +40,9 @@ MINOR; bug fixes ship as PATCH.
   tag is published.
 - Test coverage now parses every GitHub workflow file to catch release-workflow
   YAML regressions before tag-push release operations.
+- Release publication now passes explicit downloaded artifact paths to
+  `gh release create` so the nested artifact directory is not uploaded as a
+  release asset.
 
 ## [0.22.0] - 2026-05-03
 
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index 68adeee..db365d3 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -13,3 +13,20 @@ def test_github_workflow_yaml_files_parse() -> None:
         assert isinstance(data, dict), workflow
         assert data.get("name"), workflow
         assert data.get("jobs"), workflow
+
+
+def test_release_workflow_uploads_explicit_downloaded_asset_files() -> None:
+    workflow = yaml.safe_load(
+        Path(".github/workflows/release.yml").read_text(encoding="utf-8")
+    )
+    release_steps = workflow["jobs"]["release"]["steps"]
+    download_step = release_steps[0]
+    create_release_script = release_steps[1]["run"]
+
+    assert download_step["uses"] == "actions/download-artifact@v8"
+    assert download_step["with"]["name"] == "civiccore-dist"
+    assert download_step["with"]["path"] == "release-assets/"
+    assert "release-assets/dist/*" in create_release_script
+    assert "release-assets/release-attestation.json \\" in create_release_script
+    assert "release-assets/release-attestation.json.bundle \\" in create_release_script
+    assert "release-assets/*" not in create_release_script