Skip to content

Update actions/attest-build-provenance action to v4#184051

Merged
boomanaiden154 merged 1 commit intollvm:mainfrom
renovate-bot:renovate/major-github-update-gha-dependencies
Mar 2, 2026
Merged

Update actions/attest-build-provenance action to v4#184051
boomanaiden154 merged 1 commit intollvm:mainfrom
renovate-bot:renovate/major-github-update-gha-dependencies

Conversation

@renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Mar 2, 2026 •
edited by boomanaiden154
Loading

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action major v3.1.0 → v4.1.0

Release Notes.

Note

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

@llvmbot
Copy link
Member

llvmbot commented Mar 2, 2026

@llvm/pr-subscribers-github-workflow

Author: Mend Renovate (renovate-bot)

Changes

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action major v3.1.0 → v4.1.0

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

<details>
<summary>actions/attest-build-provenance (actions/attest-build-provenance)</summary>

v4.1.0

Compare Source

> [!NOTE]
> As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.
>
> Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: <actions/attest-build-provenance@v4.0.0...v4.1.0>

v4.0.0

Compare Source

> [!NOTE]
> As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.
>
> Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: <actions/attest-build-provenance@v3.2.0...v4.0.0>

v3.2.0

Compare Source

What's Changed

Full Changelog: <actions/attest-build-provenance@v3.1.0...v3.2.0>

</details>

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 12:59 AM, only on Monday ( * 0 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • <!-- rebase-check -->If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Full diff: https://github.com/llvm/llvm-project/pull/184051.diff

1 Files Affected:

  • (modified) .github/workflows/upload-release-artifact/action.yml (+1-1)
diff --git a/.github/workflows/upload-release-artifact/action.yml b/.github/workflows/upload-release-artifact/action.yml
index bf1f74a5bcf35..165e69ec0fd44 100644
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -62,7 +62,7 @@ runs:
 
     - name: Attest Build Provenance
       id: provenance
-      uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
+      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
       with:
         subject-path: ${{ steps.download-artifact.outputs.download-path }}/*

boomanaiden154
boomanaiden154 approved these changes Mar 2, 2026
View reviewed changes
Copy link
Contributor

@boomanaiden154 boomanaiden154 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. This upgrade should preserve behavior, but it makes attest-build-provenance a wrapper over attest. We should move over at some point, but we can land this for now.

@boomanaiden154 boomanaiden154 merged commit 8fff1c0 into llvm:main Mar 2, 2026
13 of 14 checks passed
@renovate-bot renovate-bot deleted the renovate/major-github-update-gha-dependencies branch March 2, 2026 03:16
sahas3 pushed a commit to sahas3/llvm-project that referenced this pull request Mar 4, 2026
@renovate-bot @sahas3
Update actions/attest-build-provenance action to v4 (llvm#184051)
f868d53 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v3.1.0` → `v4.1.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](..llvm/issues/160328) for more information.

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&llvm#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&llvm#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&llvm#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&llvm#8203;malancas](https://redirect.github.com/malancas) in
[#&llvm#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&llvm#8203;malancas](https://redirect.github.com/malancas) in
[#&llvm#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 12:59 AM, only on
Monday ( * 0 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/llvm/llvm-project).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
sujianIBM pushed a commit to sujianIBM/llvm-project that referenced this pull request Mar 5, 2026
@renovate-bot @sujianIBM
Update actions/attest-build-provenance action to v4 (llvm#184051)
b1f85d9 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | major | `v3.1.0` → `v4.1.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](..llvm/issues/160328) for more information.

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v4.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Update RELEASE.md docs by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;836](https://redirect.github.com/actions/attest-build-provenance/pull/836)
- Bump `actions/attest` from 4.0.0 to 4.1.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;838](https://redirect.github.com/actions/attest-build-provenance/pull/838)
- Bump `@actions/attest` from 3.0.0 to 3.1.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#362](https://redirect.github.com/actions/attest/pull/362)
- Bump `@actions/attest` from 3.1.0 to 3.2.0 by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#365](https://redirect.github.com/actions/attest/pull/365)
- Add new `subject-version` input for inclusion in storage record by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#364](https://redirect.github.com/actions/attest/pull/364)
- Add storage record content to README by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[actions/attest#366](https://redirect.github.com/actions/attest/pull/366)

**Full Changelog**:
<actions/attest-build-provenance@v4.0.0...v4.1.0>

###
[`v4.0.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0)

> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper
on top of
[`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the
`attest-build-provenance` action, but new implementations should use
`actions/attest` instead.

#### What's Changed

- Prepare v4 release by
[@&llvm#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&llvm#8203;835](https://redirect.github.com/actions/attest-build-provenance/pull/835)

**Full Changelog**:
<actions/attest-build-provenance@v3.2.0...v4.0.0>

###
[`v3.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v3.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0)

#### What's Changed

- Bump [@&llvm#8203;actions/core](https://redirect.github.com/actions/core)
from 1.11.1 to 2.0.1 by
[@&llvm#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&llvm#8203;776](https://redirect.github.com/actions/attest-build-provenance/pull/776)
- Add more documentation on Artifact Metadata Storage Records by
[@&llvm#8203;malancas](https://redirect.github.com/malancas) in
[#&llvm#8203;797](https://redirect.github.com/actions/attest-build-provenance/pull/797)
- Update actions/attest to latest version v3.2.0 by
[@&llvm#8203;malancas](https://redirect.github.com/malancas) in
[#&llvm#8203;812](https://redirect.github.com/actions/attest-build-provenance/pull/812)

**Full Changelog**:
<actions/attest-build-provenance@v3.1.0...v3.2.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 12:59 AM, only on
Monday ( * 0 * * 1 ) (UTC), Automerge - At any time (no schedule
defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/llvm/llvm-project).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40My4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@boomanaiden154 boomanaiden154 boomanaiden154 approved these changes

Assignees

@boomanaiden154 boomanaiden154

Labels

github:workflow

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@renovate-bot @llvmbot @boomanaiden154