reverse the upload order

dist/index.js

@@ -106885,10 +106885,6 @@ async function run() {
         const archives = await fsHelper.createArchives(stagedActionFilesDir, archiveDir);
         const manifest = ociContainer.createActionPackageManifest(archives.tarFile, archives.zipFile, options.nameWithOwner, options.repositoryId, options.repositoryOwnerId, options.sha, semverTag.raw, new Date());
         const manifestDigest = ociContainer.sha256Digest(manifest);
-        const publishedDigest = await publishImmutableActionVersion(options, semverTag.raw, archives.zipFile, archives.tarFile, manifest);
-        if (manifestDigest !== publishedDigest) {
-            throw new Error(`Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`);
-        }
         // Attestations are not supported in GHES.
         if (!options.isEnterprise) {
             const { bundle, bundleDigest } = await generateAttestation(manifestDigest, semverTag.raw, options);
@@ -106905,6 +106901,10 @@ async function run() {
                 core.setOutput('referrer-index-manifest-sha', referrerIndexSHA);
             }
         }
+        const publishedDigest = await publishImmutableActionVersion(options, semverTag.raw, archives.zipFile, archives.tarFile, manifest);
+        if (manifestDigest !== publishedDigest) {
+            throw new Error(`Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`);
+        }
         core.setOutput('package-manifest-sha', publishedDigest);
     }
     catch (error) {

src/main.ts

@@ -53,20 +53,6 @@ export async function run(): Promise<void> {
 
     const manifestDigest = ociContainer.sha256Digest(manifest)
 
-    const publishedDigest = await publishImmutableActionVersion(
-      options,
-      semverTag.raw,
-      archives.zipFile,
-      archives.tarFile,
-      manifest
-    )
-
-    if (manifestDigest !== publishedDigest) {
-      throw new Error(
-        `Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`
-      )
-    }
-
     // Attestations are not supported in GHES.
     if (!options.isEnterprise) {
       const { bundle, bundleDigest } = await generateAttestation(
@@ -109,6 +95,20 @@ export async function run(): Promise<void> {
       }
     }
 
+    const publishedDigest = await publishImmutableActionVersion(
+      options,
+      semverTag.raw,
+      archives.zipFile,
+      archives.tarFile,
+      manifest
+    )
+
+    if (manifestDigest !== publishedDigest) {
+      throw new Error(
+        `Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`
+      )
+    }
+
     core.setOutput('package-manifest-sha', publishedDigest)
   } catch (error) {
     // Fail the workflow run if an error occurs