Chore: Migrate from attest-build-provenance to attest

[ModeSevenIndustrialSolutions]

Finding

actions/attest-build-provenance has become a no-op wrapper. From its v4.2.2 release notes:

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

Reading its action.yml confirms this literally: the composite forwards every input verbatim to actions/attest@508db95 # v4.2.1 and contains no logic of its own. When no predicate-type/predicate is supplied, actions/attest emits SLSA build provenance by default, so there is nothing to hand-roll on migration.

Usage in this repository

.github/workflows/build-test-release.yaml L963, pinned 4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2.

This is the blob/artefact path (subject-path), which maps one-to-one onto actions/attest — swap the uses: line and pin, leave the with: block and the id-token: write / attestations: write permissions untouched.

Worth considering while in here

actions/attest exposes a first-class sbom-path input for SBOM attestations that the wrapper does not usefully surface. If this repo produces an SBOM, attesting it alongside the build artefact is close to free. Optional, and fine to split into its own issue.

Priority

Deferred, not urgent. GitHub is explicit that existing applications may continue using the wrapper; nothing is broken or carries a removal date. This issue exists so the finding is recorded rather than rediscovered, and so the migration happens deliberately rather than as a drive-by.

References

• actions/attest
• actions/attest-build-provenance v4.2.2 release notes
• GitHub docs: Use artifact attestations
• GitHub docs: Using artifact attestations to establish provenance for builds
• Original finding and portfolio-wide survey: Feat: Add attestation and Sigstore signing to merge node-workflows#53 (comment)

[ModeSevenIndustrialSolutions]

Correction to the wording above (no change to the work here)

I described actions/attest-build-provenance as a "pure passthrough" that "adds no logic of its own". That is inaccurate: the v4 wrapper also sets NODE_OPTIONS: "--max-http-header-size=32768" on its actions/attest step, added by actions/attest-build-provenance#687 because node's default 16KB header limit overflows against some OCI registries when pushing attestations to a registry.

This repository does not use push-to-registry, so the setting has no effect here and the migration remains a like-for-like swap of the uses: line and pin. No change to the work described above.

Recording it because two of the six repositories carrying this migration do use that input — lfreleng-actions/docker-workflows#41 and lfreleng-actions/sigul-sign-docker#192 — and there the setting must be carried across explicitly. Both issues are updated.

"Thin wrapper" is the accurate description, not "pure passthrough". Credit to Copilot for catching this on lfreleng-actions/node-workflows#57.