concourse
source.tar.gz does not match Github release tar.gz
The release tarball from the Github release page does differ from the source.tar.gz provided by the Github Release Resource.
If the tarball is downloaded from the Github release page, the main directory inside of the tarball has the project name and the current version. The source.tar.gz on the other side got the project name and part of a hash.
For example this tarball https://github.com/cloudfoundry/cli/archive/v6.32.0.tar.gz has the directory name cli-6.32.0 and the one from the github resource with the same version and in theory content has cloudfoundry-cli-829c87e.
It would be great if either the github-release-resource source.tar.gz would have the same content as the official tarball from the Github page or there is an option get this behavior.
Especially for building packages and similar it would be helpful to have the version in the directory name, so no extra intelligence is needed to determine the first parts of some commit hash.
Our package build service system now also complains that the release tarballs do mismatch which is true.
Because the source url, which is specified in the rpm spec, looks for example like this https://github.com/cloudfoundry/cli/archive/v%{version}.tar.gz
The actual file in our rpm tree comes from a Concourse pipeline which uses the github-release-resource to get the latest tarball. But this tarball references a commit or tag and not the released version which results in different tarballs and checksums. The content should be the same but the directory name is not.