[CO-2c-fix] fix release asset paths

.github/workflows/release.yml

@@ -129,7 +129,7 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           name: civiccore-dist
-          path: dist/
+          path: release-assets/
 
       - name: Create GitHub release with wheel + sdist
         env:
@@ -153,7 +153,10 @@ jobs:
           sha256sum -c SHA256SUMS.txt
           ```
           EOF
-          gh release create "${{ github.ref_name }}" dist/* \
+          gh release create "${{ github.ref_name }}" \
+            release-assets/dist/* \
+            release-assets/release-attestation.json \
+            release-assets/release-attestation.json.bundle \
             --repo "$GH_REPO" \
             --title "civiccore ${{ github.ref_name }}" \
             --notes-file release-notes.md

CHANGELOG.md

@@ -40,6 +40,9 @@ MINOR; bug fixes ship as PATCH.
   tag is published.
 - Test coverage now parses every GitHub workflow file to catch release-workflow
   YAML regressions before tag-push release operations.
+- Release publication now passes explicit downloaded artifact paths to
+  `gh release create` so the nested artifact directory is not uploaded as a
+  release asset.
 
 ## [0.22.0] - 2026-05-03
 

tests/test_github_workflows.py

@@ -13,3 +13,20 @@ def test_github_workflow_yaml_files_parse() -> None:
         assert isinstance(data, dict), workflow
         assert data.get("name"), workflow
         assert data.get("jobs"), workflow
+
+
+def test_release_workflow_uploads_explicit_downloaded_asset_files() -> None:
+    workflow = yaml.safe_load(
+        Path(".github/workflows/release.yml").read_text(encoding="utf-8")
+    )
+    release_steps = workflow["jobs"]["release"]["steps"]
+    download_step = release_steps[0]
+    create_release_script = release_steps[1]["run"]
+
+    assert download_step["uses"] == "actions/download-artifact@v8"
+    assert download_step["with"]["name"] == "civiccore-dist"
+    assert download_step["with"]["path"] == "release-assets/"
+    assert "release-assets/dist/*" in create_release_script
+    assert "release-assets/release-attestation.json \\" in create_release_script
+    assert "release-assets/release-attestation.json.bundle \\" in create_release_script
+    assert "release-assets/*" not in create_release_script