ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2

[dependabot]

Bumps actions/attest-build-provenance from 4.1.1 to 4.2.2.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

• 4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
• e3fe62e Bump the actions-minor group with 2 updates (#860)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cdeust]

ZETETIC-REVIEW: REQUEST_CHANGES

Stakes: High by criterion (touches the release/attestation supply chain .github/workflows/release.yml, which SECURITY.md presents as the verifiability guarantee for published artifacts) — full-depth review applied.

SHA↔tag correspondence (point 1, extended to Actions)

gh api repos/actions/attest-build-provenance/git/refs/tags/v4.2.2 → object sha 4d101475d8b20a2381f78447822ac1eab6504dd8, exact match to all three new pins in this diff. (Old pin 0f67c3f4... = v4.1.1, unchanged in this comparison, consistent with the diff.)

Interface-drift claim, independently re-verified (point 2)

Did not take the author's "no interface change" claim on faith — diffed the actual action.yml at both tags directly (gh api repos/actions/attest-build-provenance/contents/action.yml?ref=v4.1.1 vs ?ref=v4.2.2): the only line that differs is the internal uses: actions/attest@<sha> # v4.1.1 → # v4.2.1 pin. inputs:, outputs:, and runs: blocks are byte-identical between the two tags. release.yml only sets subject-path (never push-to-registry), so this PR's actual usage surface is untouched regardless.

Went one level deeper into the wrapped actions/attest bump (4.1.1→4.2.1) itself, since that's where the real logic lives: inputs.subject-path/subject-digest/subject-checksums requirement relaxed from "exactly one" to "at most one" (adds a new zero-input discovery mode via $GITHUB_ARTIFACTS_LIST) — additive, not a breaking narrowing. push-to-registry gained stricter validation (validateRegistrySubjects, single-subject + sha256-only) — release.yml doesn't set push-to-registry, so this is inert here. outputs: (bundle-path, attestation-id, attestation-url, storage-record-ids) confirmed byte-identical across both tags. Attestation bundle generation (predicate construction, signing) is untouched by either diff — the gh attestation verify claim in SECURITY.md (line 33) rests on bundle format, which is unaffected. Author's claim holds under independent re-derivation, not just re-reading the same compare link.

Blocking — branch is stale against origin/main, both repo gates fail as currently constituted

origin/main is 3 commits ahead of this PR's merge-base (e88e4e21): #331, #419, #427 — the latter two shrank .craftsmanship-baseline.json and re-tightened .claude-plugin/marketplace.json. Ran both gates against the current head of this branch (cf8576cd):

• python3 scripts/check_craftsmanship.py --base origin/main → exit 1, "baseline entries ADDED without a base-ref match" (7 entries the PR branch's stale baseline carries that main's shrunk baseline no longer has).
• python3 scripts/check_marketplace_pins.py → exit 1, 2 stale pins (hypermnesia-mcp-viz 3.0.0 vs v3.1.0, zetetic-team-subagents 2.36.0 vs v2.37.0) — both already fixed on origin/main.
• Confirmed clean baseline on origin/main itself (exit 0 both gates) — this is not pre-existing repo debt, it is this branch trailing main.

GitHub's green check ran against the PR's stale base, not current origin/main; merging as-is will red-X on the next gate run. Given this PR touches the attestation chain specifically, I'd weight the rebase requirement higher here than on the three Docker-digest PRs — a supply-chain-adjacent change should merge against the gate state the repo actually enforces today.

Required to unblock: rebase onto current origin/main so both repo gates pass clean. No content defect in this diff itself — the pin and the interface claim both check out under independent verification.

[cdeust]

ZETETIC-REVIEW: APPROVE

Move 0: no ledger applicable (pinned SHA bump for a single GitHub Action across three call sites in one workflow); no seen-defect rationalization present.

Verified on head e6556b6 (merge-base with origin/main == origin/main HEAD cdf084b — branch is current):

• Diff bumps actions/attest-build-provenance from 0f67c3f... (v4.1.1) to 4d10147... (v4.2.2) at all three call sites in .github/workflows/release.yml (wheel+sdist, SBOM, MCPB bundle), each with a matching version comment. SHA-to-tag correspondence and action.yml byte-identity between the two versions already established in a prior pass; not re-litigated here.
• scripts/check_craftsmanship.py --base origin/main: OK (exit 0).
• scripts/check_marketplace_pins.py: all pins current (same pre-existing unrelated NOTICE as the other three PRs).

Mergeable as-is.