Use actions/attest directly for provenance

As of v4, actions/attest-build-provenance is just a wrapper around
actions/attest, and its README recommends that new implementations
use actions/attest directly. With no predicate inputs, actions/attest
auto-generates the same SLSA build provenance, the subject-path input
is unchanged, and the existing permissions already suffice, so this
is a drop-in replacement.

Author: spacebear21

.github/workflows/crates-release.yml

@@ -118,7 +118,7 @@ jobs:
       - name: Package the crate
         run: cargo package --locked -p "$CRATE"
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: target/package/${{ needs.verify-tag.outputs.crate }}-${{ needs.verify-tag.outputs.version }}.crate
       - name: Authenticate to crates.io

.github/workflows/csharp.yml

@@ -278,8 +278,8 @@ jobs:
     # remove this line to publish without an approval gate. See README.
     environment: release
     permissions:
-      id-token: write # OIDC: used by BOTH NuGet/login and attest-build-provenance
-      attestations: write # actions/attest-build-provenance writes the attestation
+      id-token: write # OIDC: used by BOTH NuGet/login and actions/attest
+      attestations: write # actions/attest writes the attestation
       contents: read # needed only to check out the in-repo verify-tag-version action
     steps:
       - name: Checkout
@@ -326,7 +326,7 @@ jobs:
         #  well, add a second attest step with subject-checksums pointing at the
         #  SHA256SUMS produced in github-release. Not required — the nupkg is the
         #  published unit.)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: ${{ steps.locate.outputs.nupkg }}
 

.github/workflows/javascript.yml

@@ -100,7 +100,7 @@ jobs:
     environment: release
     permissions:
       id-token: write # OIDC: npm trusted publishing and its provenance statement
-      attestations: write # actions/attest-build-provenance writes the attestation
+      attestations: write # actions/attest writes the attestation
       contents: read # needed only to check out the in-repo verify-tag-version action
     steps:
       - name: Checkout
@@ -147,7 +147,7 @@ jobs:
 
       - name: Attest build provenance (tarball)
         # A consumer runs: gh attestation verify <file>.tgz -R payjoin/rust-payjoin
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: ${{ steps.locate.outputs.tarball }}