fix(release): replace SLSA reusable-workflow provenance with actions/attest-build-provenance

[debugmcpdev]

Summary

The provenance job added in #164 (slsa-framework/slsa-github-generator's reusable workflow) broke the v0.23.0 release: pushing the tag produced a hard startup_failure with zero jobs scheduled — not even unrelated ones like build-and-test.

Root cause

This org has "Write permissions for workflows" disabled (actions/permissions/workflow reports default_workflow_permissions: read; a PUT to write returns 409 "disabled by the organization"). GitHub validates a job's requested permissions against that policy at parse time, specifically for jobs that call an external reusable workflow (uses: owner/repo/.github/workflows/x.yml@ref) — even a bare-minimum such job with modest permissions triggered the same whole-run startup_failure. A normal composite action inside a normal job isn't subject to that check — proven by npm-publish's existing id-token: write step, which has worked in every prior release.

Diagnosed on a throwaway branch (deleted, never merged) by elimination: removing the job let build-and-test run; a bare-minimum reusable-workflow-call reproduced the failure in isolation; swapping to a composite action ran clean.

Fix

Replace the SLSA reusable-workflow call with actions/attest-build-provenance (a plain composite action, GitHub's own native build-provenance attestation — v4 is officially a thin wrapper on actions/attest). Same permission shape as npm-publish (id-token: write, now attestations: write instead of contents: write).

Its bundle-path output is a JSON-serialized Sigstore bundle wrapping a real in-toto statement — genuinely valid under both extensions OpenSSF Scorecard's Signed-Releases probes scan release assets for (confirmed by reading the actual probe source): releasesAreSigned wants .sigstore.json/.sig/.asc/etc.; releasesHaveProvenance wants .intoto.jsonl. Uploaded as both — same file content, not fabricated duplicates.

Verification

• actionlint clean.
• Dispatched the full redesigned workflow via workflow_dispatch with a deliberately-invalid ref input (so even if jobs ran, nothing could actually publish): all six jobs correctly scheduled this time (no startup_failure) — build-and-test failed on the poisoned ref as expected, and every downstream job (including the new provenance job) shows skipped, exactly matching needs: semantics with zero side effects to npm/PyPI/Docker Hub.
• Isolated the provenance job alone in an earlier diagnostic run: it completed success, generating a real attestation.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!