Prepare v4 release

[bdehamer]

Updates the action.yml so that this action is now simply a pass-through to actions/attest. The actions/attest action now exposes all of the capabilities previously spread across actions/attest-build-provenance and actions/attest-sbom.

The major version bump here reflects the fact that the underlying implementation has fundamentally changed, but this should be backward-compatible for anyone using v3.x of this action.

[Copilot]

Pull request overview

This PR performs a major architectural refactoring of actions/attest-build-provenance for v4, converting it from a standalone TypeScript action into a lightweight composite action wrapper around actions/[email protected]. The change consolidates attestation functionality into the actions/attest action while maintaining backward compatibility for existing users.

Changes:

• Removed all TypeScript source code, tests, build configurations, and dependencies
• Converted action.yml from a Node.js action to a composite action that passes inputs through to actions/[email protected]
• Added new optional inputs (predicate-type, predicate, predicate-path) to support custom attestations in addition to build provenance
• Updated documentation to guide users toward actions/attest for new implementations

Reviewed changes

Copilot reviewed 19 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
action.yml	Converted to composite action wrapping actions/[email protected]; added new predicate inputs and storage-record-ids output
README.md	Updated to indicate v4 is a wrapper and direct users to actions/attest for new implementations
src/main.ts, src/index.ts	Removed TypeScript source code (no longer needed)
predicate/action.yml	Removed internal predicate action (functionality now in actions/attest)
package.json, package-lock.json	Removed Node.js dependencies (no longer a TypeScript action)
tsconfig.json, tsconfig.lint.json	Removed TypeScript configurations
eslint.config.mjs, .prettierrc.json, .prettierignore, .markdown-lint.yml	Removed linting and formatting configs
jest.setup.js, tests/*	Removed unit tests (integration test remains in CI)
dist/*	Removed bundled JavaScript (no longer needed for composite action)
.node-version	Removed Node.js version specification
.github/workflows/ci.yml	Simplified to remove TypeScript tests, kept integration test
.github/workflows/codeql-analysis.yml, .github/workflows/check-dist.yml	Removed workflows no longer needed without TypeScript code

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tingx2wang]

[josegonzalez]

Is the migration as simple as replacing actions/attest-build-provenance with actions/attest in our workflows, or is there more work to be done to migrate?