Skip to content

build(deps): bump actions/attest-build-provenance from 2.4.0 to 4.1.1 #2441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump actions/attest-build-provenance from 2.4.0 to 4.1.1 #2441

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/g038-account-deletion-successor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ jobs:
--source-receipt "$RUNNER_TEMP/g038-source-receipt/receipt.json"
- name: Attest exact source receipt
id: source-attestation
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the action pin in the workflow contract test

This workflow runs backend/supabase/tests/test_g038*.py before creating the receipt, but test_g038_workflow.py still defines ATTEST as the previous e8998f... SHA and requires an exact match at line 83. Consequently, every eligible dispatch at this revision fails its own source-test suite before attestation; update the paired contract constant to the new verified SHA.

Useful? React with 👍 / 👎.

with:
subject-path: ${{ runner.temp }}/g038-source-receipt/receipt.json
- name: Upload authenticated source receipt and exact attestation bundle
Expand Down
Loading