def METHOD_NAME(checks, core_workflow=True):
    root = get_root()
    ensure_dir_exists(path_join(root, LINK_DIR))
    # Sign only what affects each wheel
    products = []
    for check in checks:
        products.append(path_join(check, 'datadog_checks'))
        setup_file = path_join(check, 'setup.py')
        if file_exists(setup_file):
            products.append(setup_file)
        project_file = path_join(check, 'pyproject.toml')
        if file_exists(project_file):
            products.append(project_file)
        dep_file = path_join(check, 'requirements.in')
        if file_exists(dep_file):
            products.append(dep_file)
    if core_workflow:
        key_id = get_key_id(GPG_COMMAND)
        # Find this latest signed link metadata file on disk.
        # NOTE: in-toto currently uses the first 8 characters of the signing keyId.
        key_id_prefix = key_id[:8].lower()
        tag_link = f'{STEP_NAME}.{key_id_prefix}.link'
        # Normalize line endings, particularly on Windows, to deal with git.
        options = {'gpg_keyid': key_id, 'normalize_line_endings': True}
    else:
        signing_key_path = os.getenv('IN_TOTO_SIGNING_KEY_PATH', '')
        signing_key = import_rsa_privatekey_from_file(signing_key_path, os.getenv('IN_TOTO_SIGNING_KEY_PASSWORD'))
        # NOTE: in-toto currently uses the first 8 characters of the signing keyID,
        # the latter of which we assume is the key filename.
        key_id_prefix = signing_key['keyid'][:8].lower()
        tag_link = f'{STEP_NAME}.{key_id_prefix}.link'
        # Do not allow machine to normalize line endings, because it is not on Windows,
        # for which git might rewrite line endings in files.
        options = {'signing_key': signing_key, 'normalize_line_endings': False}
    # Final location of metadata file.
    metadata_file = path_join(LINK_DIR, tag_link)
    with chdir(root):
        # We should ignore products untracked and ignored by git.
        run_in_toto(products, **options)
        # Check whether each signed product is being tracked AND ignored by git.
        # NOTE: We have to check now *AFTER* signing the tag link file, so that
        # we can check against the actual complete list of products.
        with open(tag_link) as tag_json:
            tag = json.load(tag_json)
            products = tag['signed']['products']
        for product in products:
            # If NOT tracked...
            if not tracked_by_git(product):
                # First, delete the tag link off disk so as not to pollute.
                os.remove(tag_link)
                # AND NOT ignored, then it most likely means the developer
                # forgot to add the file to git.
                if not ignored_by_git(product):
                    raise NeitherTrackedNorIgnoredFileException(product)
                # AND ignored, then it most likely means that incorrectly
                # recorded with in-toto files ignored by git.
                else:
                    raise UntrackedButIgnoredFileException(product)
        # Move it to the expected location.
        shutil.move(tag_link, metadata_file)
    return (metadata_file,)