fix: cover every tracked release input

scripts/generate-supply-chain.ts

@@ -32,6 +32,7 @@ import {
   type DependencyInventoryDiff,
 } from "./lib/supply-chain.ts";
 import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
+import { digestReleaseInputFiles } from "./lib/release-input-evidence.ts";
 import {
   buildRepositoryFileInventory,
   parseRepositoryFileInventoryPolicy,
@@ -66,16 +67,6 @@ async function sha256File(file: string): Promise<string> {
   return createHash("sha256").update(await readFile(file)).digest("hex");
 }
 
-async function digestFileSet(files: string[]): Promise<string> {
-  const rows = await Promise.all(
-    files.sort().map(async (file) => ({
-      path: file.replaceAll("\\", "/"),
-      sha256: await sha256File(file),
-    })),
-  );
-  return supplyChainDigest(rows);
-}
-
 async function optionalJson(file: string): Promise<Document | null> {
   try {
     const parsed: unknown = JSON.parse(await readFile(file, "utf8"));
@@ -279,7 +270,7 @@ const vulnerabilityReport = {
 };
 
 const sourceFiles = [...repositoryInventory.trackedFiles];
-const sourceSetSha256 = await digestFileSet(sourceFiles);
+const sourceSetSha256 = await digestReleaseInputFiles(sourceFiles);
 
 const components = inventory.dependencies.map((dependency) => ({
   type: "library",