Your attached binary asset to the release 1.0.8 is a .tar with a .tar.gz extension

[maxhbr]

Just a minor thing but maybe surprising:

I looked at https://github.com/microsoft/component-detection/releases/download/v1.0.8/component-detection.tar.gz with

$ md5sum component-detection.tar
21ff593d6c89fb1f55f6035526c52a82  component-detection.tar

and it is just a tar:

$ file component-detection.tar.gz
component-detection.tar.gz: POSIX tar archive (GNU)

[JamieMagee]

Whoops! Thanks for reporting. Looks like it's happening here:

component-detection/.github/workflows/build-release.yml

Lines 40 to 60 in 8b392ce

	- name: Tar the output
	run: tar -C ./dist -cvf ./dist-release/component-detection.tar.gz .
	- name: Get release
	if: github.event_name == 'release'
	id: get_release
	uses: bruceadams/get-release@v1.2.3
	env:
	GITHUB_TOKEN: ${{ github.token }}
	- name: Upload Extension Release Asset
	id: upload-component-detection-release-asset
	if: github.event_name == 'release'
	uses: actions/upload-release-asset@v1.0.2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	upload_url: ${{ steps.get_release.outputs.upload_url }}
	asset_path: ./dist-release/component-detection.tar.gz
	asset_name: component-detection.tar.gz
	asset_content_type: application/zip

I'm probably going to drop this artifact from releases going forward (See #37). It contains platform-independent, runtime dependent binaries i.e. runs on any OS that has a .NET Core 3.1 runtime installed. Instead I'll be uploading platform-dependent, runtime-independent binaries i.e. OS specific, but doesn't require a .NET Core 3.1 rune to be installed.

I think this will be easier to get up and running with, but happy to hear what would work best for you?

[maxhbr]

That sounds good, the platform-dependent binaries are probably better

[JamieMagee]

Closed by #37