From 971b979a836eec8c205fd3cd3f35b4a2b1a8d43c Mon Sep 17 00:00:00 2001
From: Obed0101 <dibujos.obed@gmail.com>
Date: Thu, 3 Sep 2026 19:05:23 -0500
Subject: [PATCH] fix: verify release attestations one artifact at a time

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eb5cf889..e8c1aa8b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -415,7 +415,9 @@ jobs:
           \`\`\`bash
           gh release download ${tag} --repo ${GITHUB_REPOSITORY}
           shasum -a 256 -c SHA256SUMS
-          gh attestation verify --repo ${GITHUB_REPOSITORY} mendcode-*.zip mendcode-*.tar.gz SHA256SUMS RELEASE-MANIFEST.txt mendcode.spdx.json
+          for file in mendcode-*.zip mendcode-*.tar.gz SHA256SUMS RELEASE-MANIFEST.txt mendcode.spdx.json; do
+            gh attestation verify --repo ${GITHUB_REPOSITORY} "$file"
+          done
           \`\`\`
           EOF
           gh release create "$tag" \