Chore: Migrate from attest-build-provenance to attest

[ModeSevenIndustrialSolutions]

Closes #55

Why

From the actions/attest-build-provenance v4.2.2 release notes:

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

Its action.yml is a composite whose single step forwards all eleven inputs to actions/attest@508db95. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance by default, so nothing needs hand-rolling.

It is a thin wrapper rather than an empty one. It also sets:

      env:
        NODE_OPTIONS: "--max-http-header-size=32768"

added by actions/attest-build-provenance#687 because node's default 16KB header limit overflows against some OCI registries when pushing attestations to a registry. I originally described the wrapper as a "pure passthrough"; Copilot caught that, and it is corrected here and in the five sibling migration issues.

This job sets no push-to-registry, so the setting has no bearing and the swap is behaviour-preserving. Two of the six repositories carrying this migration do use that input — docker-workflows (conditional on ghcr.io/) and sigul-sign-docker (true unconditionally) — and both issues are updated to require carrying NODE_OPTIONS across.

Change

One uses: line in the attest job of build-test-release.yaml, plus the README reference and an explanatory comment:

-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2

subject-path and the job's id-token: write / attestations: write permissions are unchanged.

The new pin 1e69f48 is v4.2.2 of actions/attest, verified via the API to be a commit SHA rather than a tag object:

GET /repos/actions/attest/git/ref/tags/v4.2.2
  → object.type = "commit", sha = 1e69f48acb82d1966a394da916b4c1698aa569d6

Relationship to #56

#56 adds attestation to the merge lane and uses actions/attest from the outset, since it is new code. This PR covers the pre-existing tag-driven lane, so both end up on the same action rather than the repo carrying one of each.

The two touch different files (merge.yaml vs build-test-release.yaml) and are independent — neither blocks the other, and they merge in either order.

Scope

Deliberately narrow. This is one of six identical migrations across the portfolio (docker-workflows#41, go-workflows#49, python-build-action#249, sigul-sign-docker#192, workflows-template#39); each is tracked and changed in its own repository rather than batched.

Two things I did not bundle, to keep this atomic:

• SBOM attestation. actions/attest exposes a first-class sbom-path input that the wrapper does not usefully surface, and this workflow already has an sbom job — so attesting the SBOM alongside the tarball is nearly free. That is a feature, not a migration, and belongs in its own issue.
• Pin bumps. Both relevant pins were already at latest, so nothing needed bumping.

Validation

• prek run --all-files — all hooks pass, including actionlint and gha-workflow-linter, which resolve the new pin
• markdown-table-fixer lint . --auto-fix — no issues
• aislop ci — exit 0. Note it reports files: 0: this repo is YAML and Markdown only, so the scanner has nothing in scope. Recording that rather than presenting it as a meaningful pass.
• grep confirms no attest-build-provenance reference remains outside the explanatory comment.

The attest job is release-gated and this repo holds no release credentials, so CI exercises the build/test lane rather than this job. The change is an action swap with identical inputs, so the risk sits almost entirely in whether the pin resolves — which gha-workflow-linter checks.

[Copilot]

Pull request overview

Migrates tag-driven release provenance generation to the recommended actions/attest action.

Changes:

• Replaces the deprecated wrapper with SHA-pinned actions/attest v4.2.2.
• Updates workflow documentation and README references.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
README.md	References the new attestation action.
.github/workflows/build-test-release.yaml	Migrates provenance generation and adds rationale.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.