From e4a4e75e7711caf0e929b573b2528de86107e63d Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 9 Mar 2026 21:01:57 +0800 Subject: [PATCH] Update actions/attest-build-provenance action to v4 (#18382) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance) | action | major | `v3.2.0` → `v4.1.0` | --- ### Release Notes
actions/attest-build-provenance (actions/attest-build-provenance) ### [`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0) > \[!NOTE] > As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest). > > Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead. #### What's Changed - Update RELEASE.md docs by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​836](https://redirect.github.com/actions/attest-build-provenance/pull/836) - Bump `actions/attest` from 4.0.0 to 4.1.0 by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​838](https://redirect.github.com/actions/attest-build-provenance/pull/838) - Bump `@actions/attest` from 3.0.0 to 3.1.0 by [@​bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#362](https://redirect.github.com/actions/attest/pull/362) - Bump `@actions/attest` from 3.1.0 to 3.2.0 by [@​bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#365](https://redirect.github.com/actions/attest/pull/365) - Add new `subject-version` input for inclusion in storage record by [@​bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#364](https://redirect.github.com/actions/attest/pull/364) - Add storage record content to README by [@​bdehamer](https://redirect.github.com/bdehamer) in [actions/attest#366](https://redirect.github.com/actions/attest/pull/366) **Full Changelog**: ### [`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0) > \[!NOTE] > As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest). > > Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead. #### What's Changed - Prepare v4 release by [@​bdehamer](https://redirect.github.com/bdehamer) in [#​835](https://redirect.github.com/actions/attest-build-provenance/pull/835) **Full Changelog**:
--- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/astral-sh/uv). Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/build-docker.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 4d6df89ad..bb987aabd 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -217,7 +217,7 @@ jobs: - name: Generate artifact attestation for base image if: ${{ needs.docker-plan.outputs.push == 'true' }} - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-name: ${{ env.UV_GHCR_IMAGE }} subject-digest: ${{ steps.build.outputs.digest }} @@ -341,7 +341,7 @@ jobs: - name: Generate artifact attestation if: ${{ needs.docker-plan.outputs.push == 'true' }} - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-name: ${{ env.UV_GHCR_IMAGE }} subject-digest: ${{ steps.build-and-push.outputs.digest }} @@ -385,7 +385,7 @@ jobs: # See `docker-annotate-base` for details. - name: Generate artifact attestation if: ${{ needs.docker-plan.outputs.push == 'true' }} - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-name: ${{ env.UV_GHCR_IMAGE }} subject-digest: ${{ steps.manifest-digest.outputs.digest }} @@ -468,7 +468,7 @@ jobs: echo "digest=${digest}" >> "$GITHUB_OUTPUT" - name: Generate artifact attestation - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: subject-name: ${{ env.UV_GHCR_IMAGE }} subject-digest: ${{ steps.manifest-digest.outputs.digest }}