deb-sign: Download the build artifact by name

Author: DaniusKalv

.github/workflows/deb-sign.yml

@@ -1,12 +1,16 @@
 name: Sign .deb bundles
 
-# Bundles every build artifact of the calling run into per-artifact
-# tarballs, writes SHA256SUMS, signs it with the archive key and
-# verifies the signature against the published keyring. Uploads the
-# result as the release-assets artifact.
+# Bundles the named build artifact into a tarball, writes SHA256SUMS,
+# signs it with the archive key and verifies the signature against the
+# published keyring. Uploads the result as the release-assets artifact.
 
 on:
   workflow_call:
+    inputs:
+      artifact:
+        description: Name of the build artifact to bundle and sign
+        type: string
+        required: true
     secrets:
       ARCHIVE_GPG_SIGNING_KEY:
         description: ASCII-armored private signing key, passphrase-less
@@ -28,9 +32,13 @@ jobs:
           repository: Kurokesu/ci
           sparse-checkout: keys
 
+      # Download by explicit name into an explicit directory. A bare
+      # download-all flattens a single artifact into the path itself,
+      # which broke the per-artifact glob below.
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          path: artifacts/
+          name: ${{ inputs.artifact }}
+          path: artifacts/${{ inputs.artifact }}
 
       - name: Bundle assets
         run: |

.github/workflows/dkms-release.yml

@@ -133,6 +133,8 @@ jobs:
   sign:
     needs: build
     uses: Kurokesu/ci/.github/workflows/deb-sign.yml@main
+    with:
+      artifact: ${{ needs.build.outputs.artifact }}
     secrets:
       ARCHIVE_GPG_SIGNING_KEY: ${{ secrets.ARCHIVE_GPG_SIGNING_KEY }}