v4.1.0

Note

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update RELEASE.md docs by @bdehamer in #836
• Bump actions/attest from 4.0.0 to 4.1.0 by @bdehamer in #838
  • Bump @actions/attest from 3.0.0 to 3.1.0 by @bdehamer in actions/attest#362
  • Bump @actions/attest from 3.1.0 to 3.2.0 by @bdehamer in actions/attest#365
  • Add new subject-version input for inclusion in storage record by @bdehamer in actions/attest#364
  • Add storage record content to README by @bdehamer in actions/attest#366

Full Changelog: v4.0.0...v4.1.0

v4.0.0

Note

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Prepare v4 release by @bdehamer in #835

Full Changelog: v3.2.0...v4.0.0

v3.2.0

What's Changed

• Bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in #776
• Add more documentation on Artifact Metadata Storage Records by @malancas in #797
• Update actions/attest to latest version v3.2.0 by @malancas in #812

Full Changelog: v3.1.0...v3.2.0

v3.1.0

What's Changed

• Prepare v3 release by @bdehamer in #697
• Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #749
• Bump tar from 7.5.1 to 7.5.2 by @dependabot[bot] in #753
• Bump glob from 10.4.5 to 10.5.0 by @dependabot[bot] in #754
• Bump @types/node from 24.10.1 to 25.0.2 by @dependabot[bot] in #774
• Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in #736
• Bump @actions/attest from 2.0.0 to 2.1.0 by @dependabot[bot] in #775
• Add support for creating artifact metadata storage records by @malancas in #779

New Contributors

• @malancas made their first contribution in #779

Full Changelog: v3...v3.1.0

v3.0.0

What's Changed

• Adjust node max-http-header-size setting by @bdehamer in #687
• Bump actions/attest from v2.4.0 to v3.0.0 by @bdehamer in #691
  • Bump to node24 runtime
  • Improved checksum parsing
• Bump attest-build-provenance/predicate to v2.0.0 by @bdehamer in #693
  • Bump to node24 runtime by @bdehamer in #692

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: v2.4.0...v3.0.0

v2.4.0

What's Changed

• Bump undici from 5.28.5 to 5.29.0 by @dependabot in #633
• Bump actions/attest from 2.3.0 to 2.4.0 by @bdehamer in #654
  • Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: v2.3.0...v2.4.0

v2.3.0

What's Changed

• Bump actions/attest from 2.2.1 to 2.3.0 by @bdehamer in #615
  • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: v2.2.3...v2.3.0

v2.2.3

What's Changed

• Pin actions/attest reference by commit SHA by @bdehamer in #493

Full Changelog: v2.2.2...v2.2.3

v2.2.2

What's Changed

• Bump predicate action from 1.1.4 to 1.1.5 by @bdehamer in #485
  • Bump @actions/attest from 1.5.0 to 1.6.0 by @bdehamer in #484
    • Update buildSLSAProvenancePredicate to populate workflow.ref field from the ref claim in the OIDC token (actions/toolkit#1969)

Full Changelog: v2.2.1...v2.2.2

v2.2.1

What's Changed

• Bump undici from 5.28.4 to 5.28.5 by @dependabot in #457
• Bump @octokit/request-error from 5.0.1 to 5.1.1 by @dependabot in #469
• Bump @octokit/request from 8.2.0 to 8.4.1 by @dependabot in #478
• Bump actions/attest from 2.2.0 to 2.2.1 by @bdehamer in #481
  • Includes @actions/attest v1.6.0

Full Changelog: v2.2.0...v2.2.1