ci(deps): bump actions/attest-build-provenance from 3.0.0 to 4.1.0#307
Merged
1 commit merged intodevfrom Mar 13, 2026
Merged
Conversation
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3.0.0 to 4.1.0. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@977bb37...a2bbfa2) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
dependabot
bot
added
dependencies
c-vigo
deleted the
dependabot/github_actions/dev/actions/attest-build-provenance-4.1.0
branch
This was referenced Mar 17, 2026
vig-os-release-app bot
added a commit
to vig-os/devcontainer-smoke-test
that referenced
this pull request
Mar 23, 2026
## Release 0.3.1 This PR prepares release 0.3.1 for merge to main. ### Release Content ## [0.3.1] - TBD ### Added - **Split downstream release workflow with project-owned extension hook** ([#326](vig-os/devcontainer#326)) - Add local `workflow_call` release phases (`release-core.yml`, `release-publish.yml`) and a lightweight `release.yml` orchestrator in `assets/workspace/.github/workflows/` - Add `release_kind` support with candidate mode (`X.Y.Z-rcN`) and final mode (`X.Y.Z`) in downstream release workflows - Candidate mode now auto-computes the next RC tag, skips CHANGELOG finalization/sync-issues, and publishes a GitHub pre-release - Add project-owned `release-extension.yml` stub and preserve it during `init-workspace.sh --force` upgrades - Add `validate-contract` composite action for single-source contract version validation - Add downstream release contract documentation and GHCR extension example in `docs/DOWNSTREAM_RELEASE.md` ### Changed - **Dependabot dependency update batch** ([#302](vig-os/devcontainer#302), [#303](vig-os/devcontainer#303), [#305](vig-os/devcontainer#305), [#306](vig-os/devcontainer#306), [#307](vig-os/devcontainer#307), [#308](vig-os/devcontainer#308), [#309](vig-os/devcontainer#309)) - Bump `@devcontainers/cli` from `0.81.1` to `0.84.0` and `bats-assert` from `v2.2.0` to `v2.2.4` - Bump GitHub Actions: `actions/download-artifact` (`4.3.0` -> `8.0.1`), `actions/github-script` (`7.1.0` -> `8.0.0`), `actions/attest-build-provenance` (`3.0.0` -> `4.1.0`), `actions/checkout` (`4.3.1` -> `6.0.2`) - Bump release workflow action pins: `sigstore/cosign-installer` (`4.0.0` -> `4.1.0`) and `anchore/sbom-action` (`0.22.2` -> `0.23.1`) - **Dependabot dependency update batch** ([#314](vig-os/devcontainer#314), [#315](vig-os/devcontainer#315), [#316](vig-os/devcontainer#316), [#317](vig-os/devcontainer#317)) - Bump GitHub Actions: `actions/attest-sbom` (`3.0.0` -> `4.0.0`), `actions/upload-artifact` (`4.6.2` -> `7.0.0`), `actions/create-github-app-token` (`2.2.1` -> `3.0.0`) - Bump `docker/login-action` from `3.7.0` to `4.0.0` - Bump `just` minor version from `1.46` to `1.47` - **Node24-ready GitHub Actions pin refresh for shared composite actions** ([#321](vig-os/devcontainer#321)) - Update Docker build path pins in `build-image` (`docker/setup-buildx-action`, `docker/metadata-action`, `docker/build-push-action`) to Node24-compatible releases - Set `setup-env` default Node runtime to `24` and upgrade `actions/setup-node` - Align test composite actions with newer pins (`actions/checkout`, `actions/cache`, `actions/upload-artifact`) - **Smoke-test dispatch payload now carries source run traceability metadata** ([#289](vig-os/devcontainer#289)) - Candidate release dispatches now include source repo/workflow/run/SHA metadata plus a deterministic `correlation_id` - Smoke-test dispatch receiver logs normalized source context, derives source run URL when possible, and writes it to workflow summary output - Release-cycle docs now define required vs optional dispatch payload keys and the future callback contract path for `publish-candidate` - **Smoke-test repository dispatch now runs for final releases too** ([#173](vig-os/devcontainer#173)) - `release.yml` now triggers the existing smoke-test dispatch contract for both `candidate` and `final` release kinds - Final release summaries and release-cycle documentation now reflect dispatch behavior for both release modes - **Workspace CI templates now use a single container-based workflow** ([#327](vig-os/devcontainer#327)) - Consolidate `assets/workspace/.github/workflows/ci.yml` as the canonical CI workflow and remove the obsolete `ci-container.yml` template - Extract reusable `assets/workspace/.github/actions/resolve-image` and run workspace release tests in the same containerized workflow model - Update smoke-test and release-cycle documentation to reference the single CI workflow contract - **Final release now requires downstream RC pre-release gate** ([#331](vig-os/devcontainer#331)) - Add upstream final-release validation that requires a downstream GitHub pre-release for the latest published RC tag - Move smoke-test dispatch to a dedicated release job and include `release_kind` in the dispatch payload - Add downstream `repository-dispatch.yml` template that runs smoke tests and creates pre-release/final release artifacts - **Ship changelog into workspace payload and smoke-test deploy root** ([#333](vig-os/devcontainer#333)) - Sync canonical `CHANGELOG.md` into both workspace root and `.devcontainer/` template paths - Smoke-test dispatch now copies `.devcontainer/CHANGELOG.md` to repository root so deploy output keeps a root changelog - **Final release now publishes a GitHub Release with finalized notes** ([#310](vig-os/devcontainer#310)) - Add a final-only publish step in `.github/workflows/release.yml` that creates a GitHub Release for `X.Y.Z` - Source GitHub Release notes from the finalized `CHANGELOG.md` section and fail the run if notes extraction or release publishing fails - **Release dispatch and publish ordering hardened for 0.3.1** ([#336](vig-os/devcontainer#336)) - Make smoke-test dispatch fire-and-forget in `.github/workflows/release.yml` and decouple rollback from downstream completion timing - Add bounded retries to the final-release downstream RC pre-release gate API check - Move final GitHub Release creation to the end of publish so artifact publication/signing completes before release object creation - Add concurrency control to `assets/smoke-test/.github/workflows/repository-dispatch.yml` to prevent overlapping dispatch races - Handle smoke-test dispatch failures with a targeted issue while avoiding destructive rollback after publish artifacts are already released - **Redesigned smoke-test dispatch release orchestration** ([#358](vig-os/devcontainer#358)) - Replace premature `publish-release` behavior with full downstream orchestration: deploy-to-dev merge gate, `prepare-release.yml`, release PR readiness/approval, and `release.yml` dispatch polling - Add upstream failure issue reporting with job-phase results and cleanup guidance when dispatch orchestration fails - **Smoke-test release orchestration now runs as two phases** ([#402](vig-os/devcontainer#402)) - Keep `repository-dispatch.yml` focused on deploy/prepare/release-PR readiness and move release dispatch to a dedicated merged-PR workflow (`on-release-pr-merge.yml`) - Add release-kind labeling and auto-merge enablement for release PRs, and keep upstream failure notifications in both phases - Remove release-branch upstream `CHANGELOG.md` sync from `repository-dispatch.yml` (previously added in [#358](vig-os/devcontainer#358)) - **Dependabot dependency update batch** ([#414](vig-os/devcontainer#414)) - Bump `github/codeql-action` from `4.32.6` to `4.34.1` and `anchore/sbom-action` from `0.23.1` to `0.24.0` - Bump `actions/cache` restore/save pins from `5.0.3` to `5.0.4` in `sync-issues.yml` - **Dependabot dependency update batch** ([#413](vig-os/devcontainer#413)) - Bump `@devcontainers/cli` from `0.84.0` to `0.84.1` ### Fixed - **Smoke-test deploy restores workspace CHANGELOG for prepare-release** ([#417](vig-os/devcontainer#417))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/attest-build-provenance from 3.0.0 to 4.1.0.
Release notes
Sourced from actions/attest-build-provenance's releases.
... (truncated)
Commits
a2bbfa2bump actions/attest from 4.0.0 to 4.1.0 (#838)0856891update RELEASE.md docs (#836)e4d4f7cprepare v4 release (#835)02a49bdBump github/codeql-action in the actions-minor group (#824)7c757dfBump the npm-development group with 2 updates (#825)c44148eBump github/codeql-action in the actions-minor group (#818)3234352Bump@types/nodefrom 25.0.10 to 25.2.0 in the npm-development group (#819)18db129Bump tar from 7.5.6 to 7.5.7 (#816)90fadfaBump@actions/corefrom 2.0.1 to 2.0.2 in the npm-production group (#799)57db8baBump the npm-development group across 1 directory with 3 updates (#808)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)