From 26a6c6b2b1a414e7a960d50096ddd23b131008ed Mon Sep 17 00:00:00 2001 From: Nicolas DUBIEN Date: Tue, 7 Jul 2026 00:28:04 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20Switch=20to=20actions/attest=20f?= =?UTF-8?q?or=20attestations=20(#7105)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Description > AI-agent disclosure: this PR was authored by an automated agent (Claude Code) and has not been line-by-line reviewed by a human before submission. No end-user facing change: this is a CI-only update to the publish jobs in `build-status.yml`. The provenance attestations attached to published packages and GitHub releases are produced exactly as before. As of v4, `actions/attest-build-provenance` is a thin composite wrapper around `actions/attest`: its `action.yml` forwards every input (`subject-path`, `push-to-registry`, …) untouched to `actions/attest` and re-exposes that action's outputs (`bundle-path`, `attestation-url`, …) unchanged. GitHub advises that existing users may keep the wrapper but new implementations should use `actions/attest` directly. This PR follows that advice and replaces the wrapper with the underlying action in the 7 publish jobs. Details on the swap: - `actions/attest-build-provenance@a2bbfa2…` (v4.1.0) → `actions/attest@a1948c3…` pinned to v4.1.1, the latest release (v4.1.1 only bumps bundled dependencies over the v4.1.0 commit the wrapper itself pins). - Inputs and outputs are identical between the two actions, so the `subject-path` input and the `steps.attest.outputs.bundle-path` / `attestation-url` usages need no change; with no predicate input, `actions/attest` generates the same SLSA build provenance attestation the wrapper did. - The required `permissions` (`id-token: write`, `attestations: write`) are unchanged. Impact: no version bump / changeset needed — the change is confined to CI configuration and does not touch any published package. The PR is focused on this single concern (7 identical one-line substitutions in one workflow file). No tests apply to workflow definitions; correctness was checked by comparing the two actions' `action.yml` input/output contracts at the pinned commits. ## Checklist — _Don't delete this checklist and make sure you do the following before opening the PR_ - [ ] I have a full understanding of every line in this PR — whether the code was hand-written, AI-generated, copied from external sources or produced by any other tool - [ ] I flagged the impact of my change (minor / patch / major) either by running `pnpm run bump` or by following the instructions from the changeset bot - [ ] I kept this PR focused on a single concern and did not bundle unrelated changes - [ ] I followed the [gitmoji](https://gitmoji.dev/) specification for the name of the PR, including the package scope (e.g. `🐛(vitest) Something...`) when the change targets a package other than `fast-check` - [ ] I added relevant tests and they would have failed without my PR (when applicable) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01A4vpHyMxZvcs5vpMLYBB8L --- _Generated by [Claude Code](https://claude.ai/code/session_01A4vpHyMxZvcs5vpMLYBB8L)_ Co-authored-by: Claude --- .github/workflows/build-status.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-status.yml b/.github/workflows/build-status.yml index 3591b6a09..d6db8b6ae 100644 --- a/.github/workflows/build-status.yml +++ b/.github/workflows/build-status.yml @@ -715,7 +715,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/fast-check/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/fast-check/${{env.TGZ_NAME}} @@ -786,7 +786,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/ava/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/ava/${{env.TGZ_NAME}} @@ -857,7 +857,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/jest/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/jest/${{env.TGZ_NAME}} @@ -928,7 +928,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/packaged/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/packaged/${{env.TGZ_NAME}} @@ -999,7 +999,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/poisoning/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/poisoning/${{env.TGZ_NAME}} @@ -1070,7 +1070,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/vitest/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/vitest/${{env.TGZ_NAME}} @@ -1141,7 +1141,7 @@ jobs: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} PUBLISH_TAG: ${{github.ref == 'refs/heads/main' && 'latest' || startsWith(github.ref, 'refs/heads/next-') && 'next' || 'legacy'}} run: cd .. && npm stage publish --access public --tag "$PUBLISH_TAG" "$GITHUB_WORKSPACE/packages/worker/$TGZ_NAME" - - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 id: attest with: subject-path: packages/worker/${{env.TGZ_NAME}} -- 2.54.0