whichphp v0.1.1

A small release of the GitHub Action. The whichphp binary is built from the same code as v0.1.0.

Changes

• Provenance checked without the GitHub API. The action now verifies the release archive against the Sigstore bundle published with each release (whichphp_<version>.sigstore.json). This needs no token and no access to GitHub's attestation API. If the bundle check fails or can't run, for example when Sigstore's trust root is unreachable, the action falls back to the attestation API. Both enforce the same signer workflow and tag, plus the commit for a SHA pin, and the step fails if neither passes.
• SHA pins find their release without a token. The action looks up the release tag for a pinned commit with git ls-remote instead of the GitHub API. Together with the bundle check, tag and SHA pins now also work on GitHub Enterprise Server and GHE.com runners that can reach github.com, release-assets.githubusercontent.com and tuf-repo-cdn.sigstore.dev (plus tuf-repo.github.com with gh older than 2.83).
• No token sent off github.com. On GitHub Enterprise the action no longer sends the job's token, or a GITHUB_TOKEN the job sets, to github.com.
• New install output saying how whichphp was installed: release-verified, release-checksum-only (the runner's gh couldn't check provenance) or source.

Verify your download

sha256sum --ignore-missing -c SHA256SUMS        # on macOS: shasum -a 256 --ignore-missing -c SHA256SUMS
gh attestation verify whichphp_0.1.1_linux_amd64.tar.gz --repo yusufyildiz34/whichphp \
  --signer-workflow yusufyildiz34/whichphp/.github/workflows/release.yml --bundle whichphp_0.1.1.sigstore.json

Without --bundle, gh fetches the same provenance from GitHub's attestation API.