Upgrade to actions/attest.

aaugustin · aaugustin · commit 058b6ae93b0e · 2026-03-03T07:48:44.000+01:00
attest-build-provenance is just a wrapper around attest nowadays.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -74,6 +74,7 @@ jobs:
     permissions:
       id-token: write
       attestations: write
+      artifact-metadata: write
       contents: write
     steps:
     - name: Download artifacts
@@ -83,7 +84,7 @@ jobs:
         merge-multiple: true
         path: dist
     - name: Attest provenance
-      uses: actions/attest-build-provenance@v3
+      uses: actions/attest@v4
       with:
         subject-path: dist/*
     - name: Upload to PyPI
