[PR #26] [CLOSED] chore(deps): update actions/attest-build-provenance action to v4 #16

Closed
opened 2026-06-08 09:03:26 +00:00 by ryangr0 · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/infrastructure/pull/26
Author: @webgrip-renovate[bot]
Created: 6/2/2026
Status: Closed

Base: mainHead: renovate/actions-attest-build-provenance-4.x


📝 Commits (1)

  • 6b2dbdb chore(deps): update actions/attest-build-provenance action to v4

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 .github/actions/cosign-sign-attest/action.yml (+1 -1)

📄 Description

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action major v2v4

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.0

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0

v4.0.0

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0

v4

Compare Source

v3.2.0

Compare Source

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0

v3.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v3...v3.1.0

v3.0.0

Compare Source

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0

v3

Compare Source

v2.4.0

Compare Source

What's Changed

  • Bump undici from 5.28.5 to 5.29.0 by @​dependabot in #​633
  • Bump actions/attest from 2.3.0 to 2.4.0 by @​bdehamer in #​654
    • Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

  • Bump actions/attest from 2.2.1 to 2.3.0 by @​bdehamer in #​615
    • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

  • Bump actions/attest from v2.1.0 to v2.2.0 by @​bdehamer in #​449
    • Includes support for now subject-checksums input parameter

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0

v2.0.1

Compare Source

What's Changed

  • Bump actions/attest from 2.0.0 to 2.0.1 by @​bdehamer in #​406
    • Deduplicate subjects before adding to in-toto statement

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.0.0...v2.0.1


Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/infrastructure/pull/26 **Author:** [@webgrip-renovate[bot]](https://github.com/apps/webgrip-renovate) **Created:** 6/2/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `renovate/actions-attest-build-provenance-4.x` --- ### 📝 Commits (1) - [`6b2dbdb`](https://github.com/webgrip/infrastructure/commit/6b2dbdb98d7d078e8c0df13684c1d0c1563cd28a) chore(deps): update actions/attest-build-provenance action to v4 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/cosign-sign-attest/action.yml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance) | action | major | `v2` → `v4` | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>actions/attest-build-provenance (actions/attest-build-provenance)</summary> ### [`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4.1.0) > \[!NOTE] > As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest). > > Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead. #### What's Changed - Update RELEASE.md docs by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836) - Bump `actions/attest` from 4.0.0 to 4.1.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838) - Bump `@actions/attest` from 3.0.0 to 3.1.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#362](https://redirect.github.com/actions/attest/pull/362) - Bump `@actions/attest` from 3.1.0 to 3.2.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#365](https://redirect.github.com/actions/attest/pull/365) - Add new `subject-version` input for inclusion in storage record by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#364](https://redirect.github.com/actions/attest/pull/364) - Add storage record content to README by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#366](https://redirect.github.com/actions/attest/pull/366) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0> ### [`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4...v4) > \[!NOTE] > As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest). > > Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead. #### What's Changed - Prepare v4 release by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0> ### [`v4`](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4) ### [`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0) #### What's Changed - Bump [@&#8203;actions/core](https://redirect.github.com/actions/core) from 1.11.1 to 2.0.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776) - Add more documentation on Artifact Metadata Storage Records by [@&#8203;malancas](https://redirect.github.com/malancas) in [#&#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797) - Update actions/attest to latest version v3.2.0 by [@&#8203;malancas](https://redirect.github.com/malancas) in [#&#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0> ### [`v3.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.1.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.1.0) #### What's Changed - Prepare v3 release by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;697](https://redirect.github.com/actions/attest-build-provenance/pull/697) - Bump js-yaml from 3.14.1 to 3.14.2 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;749](https://redirect.github.com/actions/attest-build-provenance/pull/749) - Bump tar from 7.5.1 to 7.5.2 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;753](https://redirect.github.com/actions/attest-build-provenance/pull/753) - Bump glob from 10.4.5 to 10.5.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;754](https://redirect.github.com/actions/attest-build-provenance/pull/754) - Bump [@&#8203;types/node](https://redirect.github.com/types/node) from 24.10.1 to 25.0.2 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;774](https://redirect.github.com/actions/attest-build-provenance/pull/774) - Bump [@&#8203;actions/attest](https://redirect.github.com/actions/attest) from 1.6.0 to 2.0.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;736](https://redirect.github.com/actions/attest-build-provenance/pull/736) - Bump [@&#8203;actions/attest](https://redirect.github.com/actions/attest) from 2.0.0 to 2.1.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;775](https://redirect.github.com/actions/attest-build-provenance/pull/775) - Add support for creating artifact metadata storage records by [@&#8203;malancas](https://redirect.github.com/malancas) in [#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779) #### New Contributors - [@&#8203;malancas](https://redirect.github.com/malancas) made their first contribution in [#&#8203;779](https://redirect.github.com/actions/attest-build-provenance/pull/779) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v3...v3.1.0> ### [`v3.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.0.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.0.0...v3.0.0) #### What's Changed - Adjust node max-http-header-size setting by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;687](https://redirect.github.com/actions/attest-build-provenance/pull/687) - Bump actions/attest from v2.4.0 to [v3.0.0](https://redirect.github.com/actions/attest/releases/tag/v3.0.0) by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;691](https://redirect.github.com/actions/attest-build-provenance/pull/691) - Bump to node24 runtime - Improved checksum parsing - Bump attest-build-provenance/predicate to v2.0.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;693](https://redirect.github.com/actions/attest-build-provenance/pull/693) - Bump to node24 runtime by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;692](https://redirect.github.com/actions/attest-build-provenance/pull/692) #### ⚠️ Minimum Compatible Runner Version v2.327.1 [Release Notes](https://redirect.github.com/actions/runner/releases/tag/v2.327.1) Make sure your runner is updated to this version or newer to use this release. **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0> ### [`v3`](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0) ### [`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0) #### What's Changed - Bump undici from 5.28.5 to 5.29.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633) - Bump actions/attest from 2.3.0 to [2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0) by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654) - Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0> ### [`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0) #### What's Changed - Bump `actions/attest` from 2.2.1 to 2.3.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615) - Updates `@sigstore/oci` from 0.4.0 to 0.5.0 **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0> ### [`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3) #### What's Changed - Pin actions/attest reference by commit SHA by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3> ### [`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2) #### What's Changed - Bump predicate action from 1.1.4 to 1.1.5 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485) - Bump [@&#8203;actions/attest](https://redirect.github.com/actions/attest) from 1.5.0 to 1.6.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484) - Update buildSLSAProvenancePredicate to populate `workflow.ref` field from the `ref` claim in the OIDC token ([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969)) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2> ### [`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1) #### What's Changed - Bump undici from 5.28.4 to 5.28.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457) - Bump [@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error) from 5.0.1 to 5.1.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469) - Bump [@&#8203;octokit/request](https://redirect.github.com/octokit/request) from 8.2.0 to 8.4.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478) - Bump actions/attest from 2.2.0 to 2.2.1 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481) - Includes `@actions/attest` [v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1> ### [`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0) #### What's Changed - Bump actions/attest from v2.1.0 to v2.2.0 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449) - Includes support for now `subject-checksums` input parameter **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0> ### [`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0) #### What's Changed - Update README w/ note about GH plans supporting attestations by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414) - Add `attestation-id` and `attestation-url` outputs by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415) **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0> ### [`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1) #### What's Changed - Bump actions/attest from 2.0.0 to 2.0.1 by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in [#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406) - Deduplicate subjects before adding to in-toto statement **Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v2.0.0...v2.0.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
ryangr0 2026-06-08 09:03:26 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure#16
No description provided.