Use discovery script to find all tarballs

This should also fix #61 which used to fail because sometimes "latest"
referred to a release pipeline and sometimes a normal validate pipeline.