Chore(attest): Migrate to actions/attest

actions/attest-build-provenance is a wrapper: since v4 it forwards
its inputs to actions/attest and adds nothing else, and GitHub
directs new implementations at actions/attest instead. With no
predicate supplied, actions/attest emits SLSA build provenance by
default, so the swap is behaviour-preserving.

The wrapper does contribute one thing beyond forwarding, and this
lane depends on it: it sets NODE_OPTIONS so node accepts response
headers above its 16KB default, which some OCI registries exceed on
the push-to-registry path. This workflow pushes provenance to GHCR,
so dropping the setting would reintroduce the intermittent overflow
that actions/attest-build-provenance#687 fixed. Carry it across
explicitly, with a comment recording why it must stay.

Permissions are unchanged.

Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>

Author: ModeSevenIndustrialSolutions

.github/workflows/build-test-release.yaml

@@ -1126,8 +1126,15 @@ jobs:
 
       - name: 'Attest build provenance'
         if: inputs.attestations
-        # yamllint disable-line rule:line-length
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        env:
+          # Carried over from actions/attest-build-provenance, which
+          # set this on its way through to actions/attest: node's
+          # default 16KB response header limit overflows against some
+          # OCI registries on the push-to-registry path. Removing it
+          # reintroduces actions/attest-build-provenance#687.
+          NODE_OPTIONS: '--max-http-header-size=32768'
+        # yamllint disable-line rule:line-length
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2
         with:
           subject-name: ${{ matrix.image }}
           subject-digest: ${{ matrix.digest }}

docs/BRIEF.md

@@ -296,7 +296,7 @@ Vibrant, well-maintained ecosystem; pin by commit SHA as usual:
 | `aquasecurity/trivy-action`                               | image vulnerability scan (alternative/complement to house grype lane)                                           |
 | `anchore/scan-action` (grype)                             | house-standard scanner; accepts image or SBOM input                                                             |
 | `sigstore/cosign-installer`                               | keyless image signing (`cosign sign <image>@<digest>`)                                                          |
-| `actions/attest-build-provenance`                         | SLSA provenance **for images** (`subject-name: <registry>/<image>`, `subject-digest`, `push-to-registry: true`) |
+| `actions/attest`                                          | SLSA provenance **for images** (`subject-name: <registry>/<image>`, `subject-digest`, `push-to-registry: true`) |
 | GoogleContainerTools `container-structure-test`           | declarative image tests (optional test hook)                                                                    |
 | `google/go-containerregistry` (`crane`)                   | registry-side retag/copy for the promote lane (no pull/push of layers)                                          |
 
@@ -385,8 +385,8 @@ check availability and skip-with-warning (family convention).
 - **Image SBOM**: syft against the image (not just the source tree);
   attach to releases
 - **Signing/provenance** (release lanes): cosign keyless by digest +
-  `actions/attest-build-provenance` with `push-to-registry` —
-  identical verification story to the other workflow families;
+  `actions/attest` with `push-to-registry` — identical verification
+  story to the other workflow families;
   Registry support varies and the lane routes around it: GHCR takes
   both cleanly, Docker Hub and Nexus 3 store cosign signatures under
   the tag scheme but have no dependable referrers API, so their