Use actions/attest directly for provenance

As of v4, actions/attest-build-provenance is just a wrapper around
actions/attest, and its README recommends that new implementations
use actions/attest directly.

Author: spacebear21

.github/workflows/crates-release.yml

@@ -118,7 +118,7 @@ jobs:
       - name: Package the crate
         run: cargo package --locked -p "$CRATE"
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: target/package/${{ needs.verify-tag.outputs.crate }}-${{ needs.verify-tag.outputs.version }}.crate
       - name: Authenticate to crates.io

.github/workflows/csharp.yml

@@ -261,8 +261,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/payjoin-csharp-')
     environment: release
     permissions:
-      id-token: write # OIDC: used by BOTH NuGet/login and attest-build-provenance
-      attestations: write # actions/attest-build-provenance writes the attestation
+      id-token: write # OIDC: used by BOTH NuGet/login and actions/attest
+      attestations: write # actions/attest writes the attestation
       contents: read # needed only to check out the in-repo verify-tag-version action
     steps:
       - name: Checkout
@@ -305,7 +305,7 @@ jobs:
       - name: Attest build provenance (nupkg)
         # Attesting the .nupkg covers every RID native lib inside it; a consumer
         # runs: gh attestation verify <file>.nupkg -R payjoin/rust-payjoin
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: ${{ steps.locate.outputs.nupkg }}
 

.github/workflows/javascript.yml

@@ -100,7 +100,7 @@ jobs:
     environment: release
     permissions:
       id-token: write # OIDC: npm trusted publishing and its provenance statement
-      attestations: write # actions/attest-build-provenance writes the attestation
+      attestations: write # actions/attest writes the attestation
       contents: read # needed only to check out the in-repo verify-tag-version action
     steps:
       - name: Checkout
@@ -147,7 +147,7 @@ jobs:
 
       - name: Attest build provenance (tarball)
         # A consumer runs: gh attestation verify <file>.tgz -R payjoin/rust-payjoin
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest@v4
         with:
           subject-path: ${{ steps.locate.outputs.tarball }}