Skip to content

set workflow.ref provenance field from ref claim - #1969

Merged
bdehamer merged 1 commit into
mainfrom
bdehamer/workflow-ref
Feb 26, 2025
Merged

set workflow.ref provenance field from ref claim#1969
bdehamer merged 1 commit into
mainfrom
bdehamer/workflow-ref

Conversation

@bdehamer

@bdehamer bdehamer commented Feb 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the buildSLSAProvenancePredicate function in the @actions/attest package to populate the workflow.ref field from the ref claim in the OIDC token.

For most events which trigger a workflow run (push, release, workflow_dispatch, etc) this will have no impact on generated predicate statement. For other events which may be triggered from ref-less commits, this will ensure that the populated value more accurately reflects the state of the workflow run.

@bdehamer
set workflow.ref provenance field from ref claim
0bc338a 
Updates the `buildSLSAProvenancePredicate` function to populate the
`workflow.ref` field from the `ref` claim in the OIDC token.

Signed-off-by: Brian DeHamer <bdehamer@github.com>
@bdehamer
bdehamer force-pushed the bdehamer/workflow-ref branch from c59c9d5 to 0bc338a Compare February 26, 2025 16:47
@bdehamer
bdehamer marked this pull request as ready for review February 26, 2025 16:48
@bdehamer
bdehamer requested a review from a team as a code owner February 26, 2025 16:48
bdehamer
bdehamer commented Feb 26, 2025
View reviewed changes
Comment thread packages/attest/__tests__/provenance.test.ts
Comment on lines -78 to -87

it('handle tags including "@" character', async () => {
nock.cleanAll()
await mockIssuer({
...claims,
workflow_ref: 'owner/repo/.github/workflows/main.yml@foo@1.0.0'
})
const predicate = await buildSLSAProvenancePredicate()
expect(predicate).toMatchSnapshot()
})

@bdehamer bdehamer Feb 26, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test was specifically handling the scenario where the ref was parsed from the workflow_ref claim and is no longer necessary since we no longer need to extract this value.

ejahnGithub
ejahnGithub approved these changes Feb 26, 2025
View reviewed changes

@ejahnGithub ejahnGithub left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@bdehamer
bdehamer merged commit ec9716b into main Feb 26, 2025
@bdehamer
bdehamer deleted the bdehamer/workflow-ref branch February 26, 2025 17:50
This was referenced Feb 26, 2025
Merged
Merged
Merged
denialhaag pushed a commit to munich-quantum-toolkit/qudits that referenced this pull request Sep 10, 2025
@renovate
⬆️👨‍💻 Update actions/attest-build-provenance action to v3 (#126)
8807133 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` -> `v3.0.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/munich-quantum-toolkit/qudits).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTcuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yi1hY3Rpb25zIl19-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
burgholzer pushed a commit to munich-quantum-toolkit/qusat that referenced this pull request Sep 10, 2025
@renovate
⬆️👨‍💻 Update actions/attest-build-provenance action to v2.4.0 (#196)
d3a889d 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | minor | `v2` -> `v2.4.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/munich-quantum-toolkit/qusat).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjk3LjEwIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJnaXRodWItYWN0aW9ucyJdfQ==-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@Ennash15

Ennash15 commented Jan 27, 2026

Copy link
Copy Markdown

LGTM!

Keno-00 pushed a commit to Keno-00/mqt-qudits that referenced this pull request Mar 16, 2026
@renovate @Keno-00
⬆️👨‍💻 Update actions/attest-build-provenance action to v3 (munich-qua…
0c78e50 
…ntum-toolkit#126)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` -> `v3.0.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/munich-quantum-toolkit/qudits).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTcuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yi1hY3Rpb25zIl19-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Keno-00 pushed a commit to Keno-00/mqt-qudits that referenced this pull request Mar 19, 2026
@renovate
⬆️👨‍💻 Update actions/attest-build-provenance action to v3 (munich-qua…
77b077d 
…ntum-toolkit#126)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` -> `v3.0.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/munich-quantum-toolkit/qudits).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTcuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yi1hY3Rpb25zIl19-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Keno-00 pushed a commit to Keno-00/mqt-qudits that referenced this pull request Mar 20, 2026
@renovate @Keno-00
⬆️👨‍💻 Update actions/attest-build-provenance action to v3 (munich-qua…
2a90899 
…ntum-toolkit#126)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` -> `v3.0.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/munich-quantum-toolkit/qudits).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45MS4xIiwidXBkYXRlZEluVmVyIjoiNDEuOTcuMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdpdGh1Yi1hY3Rpb25zIl19-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
alanwiss pushed a commit to WissCore/moldchat that referenced this pull request Apr 26, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#8)
d07039e 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/5) for more information.

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone UTC)

- Branch creation
  - "before 6am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/WissCore/moldchat).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Tim275 added a commit to Tim275/drova that referenced this pull request May 15, 2026
@Tim275
chore(ci): update actions/attest-build-provenance action to v4 (#158)
741e365 
📦 Drova Dependency Update — review CHANGELOG before merge.

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/50) for more information.

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

#### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

#### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Berlin)

- Branch creation
  - Every minute (`* * * * *`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzYuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvciIsInJlbm92YXRlIl19-->

Co-authored-by: Renovate Bot <tim275@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/soildata that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#45)
75a3747 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/soildata).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/gmailclassifier that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#63)
9fbb767 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/gmailclassifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/backvault that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#55)
316359a 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/backvault).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/slacklistener that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#90)
1f57f4d 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/slacklistener).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/whoopster that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#70)
4f2b73b 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/whoopster).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
tgrecojr pushed a commit to tgrecojr/turfops that referenced this pull request May 23, 2026
@renovate
chore(deps): update actions/attest-build-provenance action to v4 (#105)
497d15a 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v2` → `v4` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3...v4)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4)

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

###
[`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0)

#### What's Changed

- Prepare v3 release by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749)
- Bump tar from 7.5.1 to 7.5.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753)
- Bump glob from 10.4.5 to 10.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754)
- Bump [@&#8203;types/node](https://redirect.github.com/types/node) from
24.10.1 to 25.0.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.6.0 to 2.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 2.0.0 to 2.1.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775)
- Add support for creating artifact metadata storage records by
[@&#8203;malancas](https://redirect.github.com/malancas) in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

#### New Contributors

- [@&#8203;malancas](https://redirect.github.com/malancas) made their
first contribution in
[#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779)

**Full Changelog**:
<actions/attest-build-provenance@v3...v3.1.0>

###
[`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0)

#### What's Changed

- Adjust node max-http-header-size setting by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687)
- Bump actions/attest from v2.4.0 to
[v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691)
  - Bump to node24 runtime
  - Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693)
- Bump to node24 runtime by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692)

#### ⚠️ Minimum Compatible Runner Version

v2.327.1
[Release
Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1)

Make sure your runner is updated to this version or newer to use this
release.

**Full Changelog**:
<actions/attest-build-provenance@v2.4.0...v3.0.0>

###
[`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0)

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

#### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

#### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

#### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

#### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

#### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

#### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "after 10pm every weekday,before 5am every weekday,every weekend"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/tgrecojr/turfops).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE5NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot added a commit to LukeEvansTech/acinfinity-exporter that referenced this pull request Jul 21, 2026
@renovate
ci(github-action): update action actions/attest-build-provenance (v2.…
848ae88 
…0.0 ➔ v2.4.0) (#24)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | minor | `v2` → `v2.4.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

##### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

##### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

##### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

##### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

##### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

##### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/LukeEvansTech/acinfinity-exporter).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate Bot added a commit to LukeEvansTech/containers that referenced this pull request Jul 25, 2026
@renovate
ci(github-action): update action actions/attest-build-provenance (v2.…
807a11e 
…0.0 ➔ v2.4.0) (#22)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | minor | `v2` → `v2.4.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

##### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

##### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

##### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

##### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

##### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

##### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/LukeEvansTech/containers).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ejahnGithub ejahnGithub ejahnGithub approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bdehamer @Ennash15 @ejahnGithub