From 8a654147c11a9368b02a53e540e9e3856557f9ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 04:11:04 +0000
Subject: [PATCH] Bump actions/attest-build-provenance from 2 to 4

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2 to 4.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v2...v4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release.yml     | 6 +++---
 .github/workflows/spark-arm64.yml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 210df62..d00fcc9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -114,12 +114,12 @@ jobs:
           IDENTITY="^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/(tags/v[0-9].*|heads/main)$"
           cosign verify --certificate-identity-regexp "${IDENTITY}" --certificate-oidc-issuer https://token.actions.githubusercontent.com --output json "${COORDINATOR_IMAGE}@${COORDINATOR_DIGEST}" > dist/release/cosign-coordinator-verification.json
           cosign verify --certificate-identity-regexp "${IDENTITY}" --certificate-oidc-issuer https://token.actions.githubusercontent.com --output json "${WEB_IMAGE}@${WEB_DIGEST}" > dist/release/cosign-web-verification.json
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.COORDINATOR_IMAGE }}
           subject-digest: ${{ steps.coordinator.outputs.digest }}
           push-to-registry: true
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.WEB_IMAGE }}
           subject-digest: ${{ steps.web.outputs.digest }}
@@ -182,7 +182,7 @@ jobs:
             --output "dist/release/rarelink-${{ steps.version.outputs.value }}-linux-arm64-offline.tar.gz"
           find dist -type f ! -name SHA256SUMS.release -print0 | sort -z | xargs -0 sha256sum > dist/release/SHA256SUMS.release
 
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@v4
         with:
           subject-path: dist/release/rarelink-*-linux-arm64-offline.tar.gz
       - name: Create or update GitHub Release
diff --git a/.github/workflows/spark-arm64.yml b/.github/workflows/spark-arm64.yml
index 16ff84a..45e97b5 100644
--- a/.github/workflows/spark-arm64.yml
+++ b/.github/workflows/spark-arm64.yml
@@ -60,7 +60,7 @@ jobs:
           output: rarelink-spark-arm64-trivy.json
           severity: HIGH,CRITICAL
           exit-code: "1"
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@v4
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/rarelink-spark
           subject-digest: ${{ steps.build.outputs.digest }}