chore(deps): update actions/attest-build-provenance action to v4.2.2

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	minor	v4.1.1 → v4.2.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.2.2

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in #​862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-reviewer]

✅ Superseded by a later review.

Update type minor is eligible for auto-approval but has failed the following checks:

• ❌ org-required-trufflehog.yml ran: required workflow did not run on this commit
• ❌ self-zizmor.yaml ran: required workflow did not run on this commit

Passed checks

• ✅ PR created by Renovate
• ✅ All commits by Renovate
• ✅ All commits are signed
• ✅ Files previously updated by Renovate
• ✅ Update type: minor
• ✅ Diff check: changes only dependency lines
• ✅ Risk scan: low risk. The diff updates actions/attest-build-provenance in .github/workflows/sign-and-attest.yml from v4.1.1 to v4.2.2 (pinned by commit SHA).
• ✅ Packages previously updated

This PR will not be automatically approved. Please review manually.

Reviewer notes: Confirm the SHA 4d101475d8b20a2381f78447822ac1eab6504dd8 corresponds to the v4.2.2 tag of actions/attest-build-provenance.

[renovate-reviewer]

✅ Superseded by a later review.

Update type minor is eligible for auto-approval but has failed the following checks:

• ❌ Risk scan: medium risk. The diff updates actions/attest-build-provenance in .github/workflows/sign-and-attest.yml from v4.1.1 to v4.2.2 with a corresponding digest change.

Passed checks

• ✅ PR created by Renovate
• ✅ All commits by Renovate
• ✅ All commits are signed
• ✅ Files previously updated by Renovate
• ✅ Update type: minor
• ✅ Diff check: changes only dependency lines
• ✅ Packages previously updated
• ✅ TruffleHog Secret Scanning passed
• ✅ zizmor GitHub Actions static analysis passed

This PR will not be automatically approved. Please review manually.

Reviewer notes: Confirm the pinned digest 4d101475d8b20a2381f78447822ac1eab6504dd8 matches the genuine v4.2.2 release of actions/attest-build-provenance.