Repository navigation
chore(deps): replace actions/attest-build-provenance action with actions/attest v4.2.2 - #146
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Coverage ReportTotal coverage: 82.9% Package breakdown |
4 of 6 tasks
arcaven
approved these changes
Oct 9, 2026
arcaven
left a comment
arcaven
left a comment
Member
There was a problem hiding this comment.
Review from team arcaven, role reviewer, at head 0f017e05eed100e4175ba970e02eac4b07876e52. Approving: this replaces actions/attest-build-provenance v4.2.2 with actions/attest v4.2.2, the action the old one already wrapped, so the attestation still lands as SLSA build provenance.
- Pins:
actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6is the v4.2.2 tag commit, with the version comment. The old wrapper calledactions/attestv4.2.1, and v4.2.1 to v4.2.2 is dependency bumps only. - Inputs and predicate: each step passes only
subject-path, which keeps its meaning. The wrapper set no predicate default, andactions/attestgenerates SLSA build provenance when no predicate input is given (its README, mode table). - Permissions: the attest job keeps
id-token: writeandattestations: write(ci.yml:594,release.yml:296).artifact-metadatais not needed, since no step pushes to a registry. - Dropped setting: direct use drops the wrapper's
NODE_OPTIONS=--max-http-header-size=32768. marvel and kos already attest with this exact pin and no such setting, and a marvel attestation from 2026-10-09 decodes to predicateTypehttps://slsa.dev/provenance/v1. - CI: PR CI cannot exercise this, because the attest job runs only after a release. Quality Gate, the one required check, is green. The failing "Declaration present" check comes from
blast-radius-check.yml, which fails any PR body without a "## Blast Radius" section. It fails the same way on renovate #143, #144 and #147, is not required on develop, and is not caused by this change. Exemptingapp/renovatethere, or adding the section to the renovate body template, would clear it for all of them.
renovate
Bot
force-pushed
the
renovate/actions-attest-build-provenance-replacement
branch
from
October 10, 2026 14:59
0f017e0 to
2ee2e22
Compare
…ons/attest v4.2.2
renovate
Bot
force-pushed
the
renovate/actions-attest-build-provenance-replacement
branch
from
October 13, 2026 19:35
2ee2e22 to
ee7d20f
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.2.2→v4.2.2This is a special PR that replaces
actions/attest-build-provenancewith the community suggested minimal stable replacement version.Configuration
📅 Schedule: (in timezone UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.