chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2

[dependabot]

Bumps actions/attest-build-provenance from 4.1.1 to 4.2.2.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

• 4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
• e3fe62e Bump the actions-minor group with 2 updates (#860)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

supply-chain-guard Scan Report

WARNING: Findings were detected.

Canonical JSON report: 1 reportable finding(s).

## 🛡️ supply-chain-guard Scan Report

| Property | Value |
|----------|-------|
| Tool | `supply-chain-guard v6.0.15` |
| Target | `.` |
| Type | directory |
| Time | 2026-09-08T04:33:59.706Z |
| Commit | `dede81f6d28339a2bfad28cef1d35ce0c9466dce` |
| Detection Set | `v6.0.15 (20423 entries, generated 2026-09-07T00:00:00.000Z)` |
| Duration | 2057ms |
| **Risk Score** | **5/100** (LOW) |

### Summary

Scanned 208 of 222 files.

🟡 1 medium

### Findings

#### 🟡 [MEDIUM] Workflow requests OIDC id-token:write permission. If combined with unreviewed third-party actions or outbound curl, an attacker can steal the OIDC token to impersonate the workflow's cloud identity.

- **Rule:** `GHA_OIDC_WRITE_PERM`
- **File:** `.github/workflows/release.yml:57`
- **Match:** `id-token: write`
- **Recommendation:** Audit all steps in this workflow when id-token:write is set. Ensure no third-party action or run step can exfiltrate the OIDC token. Scope permissions as narrowly as possible.

### Recommendations

- Review the listed findings and assess whether they represent legitimate functionality or potential threats.

---
*Generated by [supply-chain-guard](https://github.com/homeofe/supply-chain-guard)*