chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1

[dependabot]

Bumps actions/attest-build-provenance from 4.1.0 to 4.1.1.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in actions/attest-build-provenance#858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

Commits

• 0f67c3f Bump actions/checkout from 6.0.3 to 7.0.0 (#857)
• 21b787d Update actions/attest to v4.1.1 (#858)
• f14352a add dependabot cooldown (#851)
• 2c04a00 Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)
• 10334b5 remove badges from README (#840)
• c5efebd remove prober workflows (#837)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

AI Risk Manager

• Decision: ready
• Headline: No blocking release-risk signal; optional cleanup remains, risk score 36.
• Risk score: 36/100
• Scope: full_fallback
• Changed files: 1
• PR delta: new=1, resolved=0, unchanged=1
• Support: l2 / supported / ci=advisory
• Profiles: code_risk:supported, ui_flow_risk:not_applicable, business_invariant_risk:not_applicable
• Fallback: changed_files_not_mapped

Why Review

• PR impact mapping fell back to full scan, so changed-file risk attribution is weaker.
• 1 repo-wide finding(s) hidden from merge triage because they do not match changed files.

Review Focus

• Review CI automation trust boundaries, permissions, and rollout behavior.

Top Risks

• [low] [new] pr_workflow_change_requires_review at .github/workflows/release.yml: PR changes repository automation and should receive explicit review. Trust: strong (0.89). Action: Review workflow permission scope, external actions, shell steps, and expected CI behavior before merge.

Suppression Hints

If a finding is intentional, add one of these entries to .airiskignore:

- key: "pr_workflow_change_requires_review:.github/workflows/release.yml:sig:pr-risk:workflow-review:.github/workflows/release.yml"

Test First

• [low] pr_workflow_change_requires_review at .github/workflows/release.yml (3 min): Review workflow permission scope, external actions, shell steps, and expected CI behavior before merge.

Full details: see pr_summary.json, merge_triage.md, report.md, findings.json, and test_plan.json.

[direct41]

Approved Dependabot update after green CI checks.