Fix Attest build provenance failing (#602)

* upload dist folder to make it accessible in provenance job

* pin commit sha's for uploading & downloading artifacts

Author: Sahilb315

.github/workflows/goreleaser.yml

@@ -79,6 +79,11 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
+      - name: Upload dist folder
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dist-artifacts
+          path: dist/
 
   provenance:
     needs: [goreleaser]
@@ -88,7 +93,13 @@ jobs:
       attestations: write # To write attestations
     runs-on: ubuntu-latest
     steps:
+      - name: Download dist folder
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: dist-artifacts
+          path: dist/
+
       - name: Attest build provenance (checksums)
         uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
         with:
-          subject-checksums: ./dist/checksums.txt
+          subject-checksums: dist/checksums.txt