ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2

[Reefact]

Summary

The change #48 proposes, carried on a branch that can actually pass the required checks. One line in .github/workflows/release.yml: the pinned SHA of actions/attest-build-provenance, v4.1.1 → v4.2.2.

What was verified

• The SHA is genuine. The GitHub API says the v4.2.2 tag points at 4d101475d8b20a2381f78447822ac1eab6504dd8, type commit — the same SHA the diff pins. On a pinned action this is the one check worth doing by hand: a SHA that does not match the tag written beside it is exactly what a compromise would look like.
• The chain stays verifiable. Since v4 the action is a wrapper over actions/attest, and the whole change between the two commits is its inner pin, 4.1.1 → 4.2.1, itself a SHA. Two files differ, action.yml by one line.
• Nothing this workflow uses moved. subject-path is still an input, and id-token: write with attestations: write are still the permissions the action asks for.
• What did move, inside actions/attest: reading subjects from GITHUB_ARTIFACTS_LIST, SHA-2 subject digests, a line-ending fix for checksums on Windows, and stripping the OCI tag when pushing an attestation to a registry — which this workflow does not do. Nothing breaking for an explicit subject-path.

Why not just merge #48

A Dependabot pull request cannot pass this repository's required SonarQube Cloud analysis check, so #48 is unmergeable for a reason that has nothing to do with its content:

The format of the analysis property sonar.token= is invalid
##[error]Process completed with exit code 1.

GitHub serves Dependabot-triggered runs a separate dependabot secret scope, so secrets.SONAR_TOKEN arrives empty. sonar.yml already guards the case it anticipated —

# A pull request from a fork cannot read SONAR_TOKEN, so the analysis would fail for a reason
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

— but Dependabot's branch lives in this repository, so head.repo.full_name == github.repository holds, the job runs, and it fails on the missing secret instead. The guard covers forks; it does not cover Dependabot.

That is structural: no Dependabot pull request can be merged while that check is required. Worth fixing separately — either by extending the guard (and handling what a skipped required check means for merging), or by adding SONAR_TOKEN to the Dependabot secret scope, which has its own trade since for a pull_request event the workflow definition comes from the PR's own branch.

#48 can be closed in favour of this.

Type of change

• Bug fix
• New feature
• Breaking change to the public API
• Refactoring
• Analyzer / diagnostic change
• Tests
• Documentation
• Build / CI / tooling

Testing

• dotnet build -c Release — not run: no code changes; the diff is one uses: line in a workflow
• dotnet test -c Release — same
• tests/PackageSmokeTest/run.sh — same

The action itself only runs on the release workflow, which this pull request does not trigger. It runs on a dry run too, deliberately, so a dry run after merging is what confirms the new pin end to end.

Public API

• No change to the public surface
• The surface changed and the baseline was updated in the same commit

Documentation

• README / docs/ updated
• The French counterpart was updated to match
• CHANGELOG.md and docs/for-users/CHANGELOG.fr.md both updated
• No documentation change required

The changelog documents the packages; the version of a workflow action is not something a consumer meets.

Related issues

Supersedes #48.

🤖 Generated with Claude Code

https://claude.ai/code/session_01M5U2BZXpHQr7YcfNHVx9dA

---

Generated by Claude Code