Fix release job's download build artifacts step

[JonatanAntoni]

No description provided.

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[qltysh]

❌ 1 blocking issue (1 total)

Tool	Category	Rule	Count
zizmor	Vulnerability	code injection via template expansion	1	❌

[qltysh]

code injection via template expansion [zizmor:zizmor/template-injection]

[Copilot]

Pull request overview

This PR updates the GitHub Actions release workflow to correctly download build artifacts produced by the build matrix and reliably upload them to the GitHub release.

Changes:

• Pin actions/download-artifact to a specific commit (v8.0.1) for the release job.
• Add skip-decompress: true when downloading artifacts into release-assets/.
• Update the gh release upload invocation to use the release tag expression directly and explicitly set --repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.