chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 by dependabot[bot] · Pull Request #3001 · gHashTag/t27

dependabot · 2026-09-01T09:17:47Z

Bumps actions/attest-build-provenance from 1 to 4.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Prepare v4 release by @bdehamer in actions/attest-build-provenance#835

Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0

v3.2.0

What's Changed

Bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in actions/attest-build-provenance#776

Add more documentation on Artifact Metadata Storage Records by @malancas in actions/attest-build-provenance#797

Update actions/attest to latest version v3.2.0 by @malancas in actions/attest-build-provenance#812

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

v3.1.0

What's Changed

Prepare v3 release by @bdehamer in actions/attest-build-provenance#697

Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in actions/attest-build-provenance#749

Bump tar from 7.5.1 to 7.5.2 by @dependabot[bot] in actions/attest-build-provenance#753

Bump glob from 10.4.5 to 10.5.0 by @dependabot[bot] in actions/attest-build-provenance#754

Bump @types/node from 24.10.1 to 25.0.2 by @dependabot[bot] in actions/attest-build-provenance#774

Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in actions/attest-build-provenance#736

Bump @actions/attest from 2.0.0 to 2.1.0 by @dependabot[bot] in actions/attest-build-provenance#775

Add support for creating artifact metadata storage records by @malancas in actions/attest-build-provenance#779

New Contributors

@malancas made their first contribution in actions/attest-build-provenance#779

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

v3.0.0

What's Changed

Adjust node max-http-header-size setting by @bdehamer in actions/attest-build-provenance#687

Bump actions/attest from v2.4.0 to v3.0.0 by @bdehamer in actions/attest-build-provenance#691

Bump to node24 runtime

Improved checksum parsing

Bump attest-build-provenance/predicate to v2.0.0 by @bdehamer in actions/attest-build-provenance#693

Bump to node24 runtime by @bdehamer in actions/attest-build-provenance#692

⚠️ Minimum Compatible Runner Version

v2.327.1 Release Notes

Make sure your runner is updated to this version or newer to use this release.

... (truncated)

Commits

4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
e3fe62e Bump the actions-minor group with 2 updates (#860)
0f67c3f Bump actions/checkout from 6.0.3 to 7.0.0 (#857)
21b787d Update actions/attest to v4.1.1 (#858)
f14352a add dependabot cooldown (#851)
2c04a00 Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)
10334b5 remove badges from README (#840)
c5efebd remove prober workflows (#837)
a2bbfa2 bump actions/attest from 4.0.0 to 4.1.0 (#838)
0856891 update RELEASE.md docs (#836)
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

dependabot · 2026-09-01T09:17:48Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-09-01T09:18:09Z

PR Dashboard

Generated at: 2026-09-01 09:18:06 UTC

chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-09-01 | 20 failing / 24 total
chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-09-01 | 15 failing / 24 total
chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 chore(ci)(deps): bump github/codeql-action from 3 to 4 | Created: 2026-09-01 | Updated: 2026-09-01 | 9 failing / 25 total
Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-08-27 | 5 failing / 24 total
chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.21 #2693 chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
chore(deps)(deps): bump hyper from 1.10.1 to 1.11.1 #2692 chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 33 total
chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 #2691 chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 #2690 chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
chore(deps)(deps): bump uuid from 1.23.2 to 1.26.1 #2689 chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	10
PRs with Failing Checks	8
PRs with All Checks Green	2
READY	0
FAILING	8
PENDING	0

Seal Status

⚠️ STALE -- sha256(compiler.rs)=fd84214651ae != manifest seal=87e5cbd3ad94.
The committed NMSE numbers were certified against an older compiler.rs.
Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

github-actions · 2026-09-01T09:18:39Z

📓 NotebookLM Notebook linked to this PR

Notebook ID: b83263109fb055dc
URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

gHashTag · 2026-10-02T16:12:33Z

Reviewer bee X. Reviewed: a one-line major bump of a pinned action; the inputs this repo passes (subject-path / files / sarif_file) are unchanged across the major, and the job permissions the new major needs (contents / id-token / attestations write where relevant) are already declared. The only red check (compile-proofs) is unrelated to workflows. Labelled bee-reviewed. Not merged by me: the change touches .github/workflows and the reviewer token lacks the workflow scope -- awaiting the owner's merge.

gHashTag · 2026-10-02T19:13:31Z

@dependabot rebase

(Reviewer bee: the required check parse-ratchet never ran on this head, which dates from 2026-09-14. A rebase gives the current required checks a fresh head to run on. I will re-review the rebased diff before re-applying bee-reviewed.)

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 1 to 4. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v1...v4) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-02T19:15:57Z

📓 NotebookLM Notebook linked to this PR

Notebook ID: b83263109fb055dc
URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

github-actions · 2026-10-02T19:20:48Z

PR Dashboard

Generated at: 2026-10-02 19:20:38 UTC

fix(seals): baseline the four html/xml seals #5580 unsealed (Refs #5577) #5612 fix(seals): baseline the four html/xml seals #5580 unsealed (Refs #5577) | Created: 2026-10-02 | Updated: 2026-10-02 | 1 failing / 34 total
docs(igla): re-take the corpus figures on master, 1150 specs (Refs #5497) #5610 docs(igla): re-take the corpus figures on master, 1150 specs (Refs #5497) | Created: 2026-10-02 | Updated: 2026-10-02 | 1 failing / 34 total
feat(xilinx7): 7-series configuration packets as a .t27 spec (Closes #5608) #5609 feat(xilinx7): 7-series configuration packets as a .t27 spec (Closes #5608) | Created: 2026-10-02 | Updated: 2026-10-02 | 4 failing / 34 total
Port gHashTag/trinity:fpga/openxc7-synth/d_clk_direct.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/d_c #5595 Port gHashTag/trinity:fpga/openxc7-synth/d_clk_direct.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/d_c | Created: 2026-10-02 | Updated: 2026-10-02 | 6 failing / 31 total
Specify contributor key management and attribution boundaries #5473 Specify contributor key management and attribution boundaries | Created: 2026-10-01 | Updated: 2026-10-02 | 4 failing / 32 total
The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it #5452 The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it | Created: 2026-10-01 | Updated: 2026-10-02 | 6 failing / 36 total
docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) #5413 docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) | Created: 2026-10-01 | Updated: 2026-10-02 | 6 failing / 32 total
Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp #5320 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp | Created: 2026-09-30 | Updated: 2026-10-02 | 8 failing / 31 total
A "using" in prose became an import; and the per-spec delta check compared strings #5215 A "using" in prose became an import; and the per-spec delta check compared strings | Created: 2026-09-29 | Updated: 2026-10-02 | 12 failing / 41 total
Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure #5084 Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure | Created: 2026-09-28 | Updated: 2026-10-02 | 10 failing / 45 total
Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus #5081 Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus | Created: 2026-09-28 | Updated: 2026-10-02 | 10 failing / 36 total
chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib #5078 chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib | Created: 2026-09-28 | Updated: 2026-10-02 | 7 failing / 40 total
Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t #4911 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t | Created: 2026-09-27 | Updated: 2026-10-02 | 11 failing / 31 total
Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it #4887 Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it | Created: 2026-09-27 | Updated: 2026-10-02 | 12 failing / 40 total
Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep #4801 Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep | Created: 2026-09-24 | Updated: 2026-10-02 | 11 failing / 31 total
Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope #4777 Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope | Created: 2026-09-24 | Updated: 2026-10-02 | 10 failing / 31 total
Generic type parameters dropped from the declaration and kept in the body: -23 errors #4745 Generic type parameters dropped from the declaration and kept in the body: -23 errors | Created: 2026-09-24 | Updated: 2026-10-02 | 12 failing / 31 total
Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 #4729 Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 | Created: 2026-09-24 | Updated: 2026-10-02 | 12 failing / 31 total
Wave 684: occlusion four deep, and the two files no list ever reached #4660 Wave 684: occlusion four deep, and the two files no list ever reached | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder #4642 Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) #4634 Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
feat(specs/skills): trinity/connect-accounts #4600 feat(specs/skills): trinity/connect-accounts | Created: 2026-09-22 | Updated: 2026-10-02 | 7 failing / 32 total
Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) #4581 Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-10-02 | 9 failing / 31 total
Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) #4578 Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-10-02 | 8 failing / 31 total
Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 #4565 Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 | Created: 2026-09-21 | Updated: 2026-10-02 | 0 failing / 2 total
Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) #4563 Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) | Created: 2026-09-21 | Updated: 2026-10-02 | 8 failing / 31 total
classify: the browser could not tell a Markdown file from a broken spec (refs #2133) #4541 classify: the browser could not tell a Markdown file from a broken spec (refs #2133) | Created: 2026-09-21 | Updated: 2026-10-02 | 7 failing / 41 total
Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 #4536 Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 | Created: 2026-09-21 | Updated: 2026-10-02 | 8 failing / 31 total
Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place #4498 Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place | Created: 2026-09-21 | Updated: 2026-10-02 | 6 failing / 30 total
specs/functions: payment-ai-server-process -- claim-invoice before crediting #4116 specs/functions: payment-ai-server-process -- claim-invoice before crediting | Created: 2026-09-17 | Updated: 2026-10-02 | 4 failing / 30 total
specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs #4113 specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs | Created: 2026-09-17 | Updated: 2026-10-02 | 4 failing / 30 total
Feed the swarm from CI, with fuel that does not run out #3978 Feed the swarm from CI, with fuel that does not run out | Created: 2026-09-17 | Updated: 2026-10-02 | 6 failing / 28 total
specs: bind every tool and skill to the Queen, and name a domain lead #3833 specs: bind every tool and skill to the Queen, and name a domain lead | Created: 2026-09-15 | Updated: 2026-10-02 | 4 failing / 30 total
specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 #3593 specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 | Created: 2026-09-13 | Updated: 2026-10-02 | 5 failing / 30 total
coq(CorePhi): replace proofs that were never checked by a compiler #3343 coq(CorePhi): replace proofs that were never checked by a compiler | Created: 2026-09-06 | Updated: 2026-10-02 | 5 failing / 32 total
chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-10-02 | 16 failing / 43 total
chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-10-02 | 8 failing / 43 total
chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 chore(ci)(deps): bump github/codeql-action from 3 to 4 | Created: 2026-09-01 | Updated: 2026-10-02 | 25 failing / 42 total
Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-10-02 | 5 failing / 24 total

Summary

Status	Count
Total Open PRs	39
PRs with Failing Checks	38
PRs with All Checks Green	1
READY	1
FAILING	38
PENDING	0
NO CHECKS YET	0

Seal Status

⚠️ STALE -- sha256(compiler.rs)=b45a356c2eb6 != manifest seal=87e5cbd3ad94.
The committed NMSE numbers were certified against an older compiler.rs.
Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

gHashTag · 2026-10-02T19:29:57Z

bee review (reviewer, not author) — head 238be1a84131e411a1f365122f6338252c2117e0

Checked:

Diff is one line in .github/workflows/sign-release.yml: actions/attest-build-provenance@v1 -> @v4. No other files.
Release notes:
- v2: multi-subject attestations; subject-path: 'dist/*' now yields one attestation listing every artifact.
- v3: Node 24 runtime; needs runner >= 2.327.1, which ubuntu-latest satisfies.
- v4: the action is now a wrapper over actions/attest.
action.yml@v4.0.0 still declares subject-path, the only input used.
The job permissions include id-token: write and attestations: write (plus contents: write for the upload step).
Required checks at this head: validate, check-linked-issue and parse-ratchet are all success.
Still mergeable after chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 (squash 5f40f66) changed the action-gh-release line in the same file. That is a separate hunk, and the head is unchanged since review.

Red checks not caused by this PR:

untrusted-input is red on master and on every open PR.
coverage is red on master.
integrity-gate and pack-index-consistency report SHA drift in conformance/vectors/*_conformance_v0.json, files this PR does not touch.

Label bee-reviewed re-applied after this head.

t27-bees

bee review: see evidence comment

dependabot Bot added the ci label Sep 1, 2026

dependabot Bot requested a review from gHashTag as a code owner September 1, 2026 09:17

dependabot Bot added the ci label Sep 1, 2026

github-actions Bot mentioned this pull request Sep 1, 2026

chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999

Merged

github-actions Bot mentioned this pull request Sep 1, 2026

chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000

Merged

gHashTag added the bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) label Oct 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions/attest-build-provenance-4 branch from c7e7cd6 to 238be1a Compare October 2, 2026 19:14

gHashTag added bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) and removed bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) labels Oct 2, 2026

t27-bees Bot approved these changes Oct 2, 2026

View reviewed changes

gHashTag merged commit f51167c into master Oct 2, 2026
42 of 48 checks passed

dependabot Bot deleted the dependabot/github_actions/actions/attest-build-provenance-4 branch October 2, 2026 19:30

Navigation Menu

Repository navigation

chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 - #3001

chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4#3001
gHashTag merged 1 commit into
masterfrom
dependabot/github_actions/actions/attest-build-provenance-4

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

t27-bees Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.0.0

What's Changed

v3.2.0

What's Changed

v3.1.0

What's Changed

New Contributors

v3.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026

Labels

Uh oh!

github-actions Bot commented Sep 1, 2026

PR Dashboard

Summary

Seal Status

Uh oh!

github-actions Bot commented Sep 1, 2026

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

PR Dashboard

Summary

Seal Status

Uh oh!

gHashTag commented Oct 2, 2026

Uh oh!

t27-bees Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading