From d912c3fbf0cb435cd95bd8c280213c267982fa6b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 17 Oct 2026 04:20:05 +0000
Subject: [PATCH] Bump actions/attest-build-provenance from 3.0.0 to 4.2.2

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 3.0.0 to 4.2.2.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/977bb373ede98d70efdf65b84cb5f73e068dcc2a...4d101475d8b20a2381f78447822ac1eab6504dd8)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8412ce8..3199219 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -139,25 +139,25 @@ jobs:
       - name: Publish tested images and assemble index without rebuilding
         id: registry
         run: python3 scripts/publish-release.py registry "$TAG"
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         id: image_index
         with:
           subject-name: ghcr.io/dk-code-factory/agent-workflow-worker
           subject-digest: ${{ steps.registry.outputs.digest }}
           push-to-registry: true
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         id: image_amd64
         with:
           subject-name: ghcr.io/dk-code-factory/agent-workflow-worker
           subject-digest: ${{ steps.registry.outputs.amd64 }}
           push-to-registry: true
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         id: image_arm64
         with:
           subject-name: ghcr.io/dk-code-factory/agent-workflow-worker
           subject-digest: ${{ steps.registry.outputs.arm64 }}
           push-to-registry: true
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         id: archives
         with:
           subject-path: dist/*.tar.gz
@@ -174,7 +174,7 @@ jobs:
           cp "$AMD64" dist/image-amd64-provenance.jsonl
           cp "$ARM64" dist/image-arm64-provenance.jsonl
       - run: python3 scripts/publish-release.py inventory "$TAG"
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         id: manifest
         with:
           subject-path: dist/release-manifest.json