fix: make download-artifacts.sh more flexible (#761)

Making the `download-artifacts.sh` script be more useful.

Before, it would error upon seeing some zip files that it doesn't expect
to be in the GH release. I think the script is just a bit outdated. But
for now, I think we should bypass that, since the script is already
written to know which of the final files within the archives are
actually needed.

related PR
slsa-framework/slsa-github-generator#3589

Signed-off-by: Ramon Petgrave <[email protected]>

download-artifacts.sh

@@ -88,6 +88,13 @@ unzip_files() {
         rm -rf "${tmp_dir}"
         ;;
 
+    # catch-all for any zip file
+    # TODO: With the commands at the end of this script, only the needed files will be copied over.
+    # But we should get specific about which files to ignore.
+    ./*.zip)
+        unzip -o "${zip_path}" -d "${output_path}"
+        ;;
+
     *)
         echo "unexpected file path: ${zip_path}"
         exit 1
@@ -183,4 +190,4 @@ copy_files "gha_delegator-binary-linux-amd64-" "${repo_path}/cli/slsa-verifier/t
 # Maven builder
 copy_files "gha_maven-binary-linux-amd64-" "${repo_path}/cli/slsa-verifier/testdata/gha_maven/${version}"
 # gradle builder
-copy_files "gha_gradle-binary-linux-amd64-" "${repo_path}/cli/slsa-verifier/testdata/gha_gradle/${version}"
+copy_files "gha_gradle-binary-linux-amd64-" "${repo_path}/cli/slsa-verifier/testdata/gha_gradle/${version}"