github-actions: bump actions/attest-build-provenance from 4.1.1 to 4.2.2

[dependabot]

Bumps actions/attest-build-provenance from 4.1.1 to 4.2.2.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

• 4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
• e3fe62e Bump the actions-minor group with 2 updates (#860)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• actions/attest-build-provenance: 4.1.1 → 4.2.2
• Reviewed head: b9cbdd101bfe418c20d4ac3703ae5e44ad74979a

Security review

• Compared the signed, immutable upstream action releases and their pinned
  actions/attest bundles. The wrapper resolves to
  4d101475d8b20a2381f78447822ac1eab6504dd8; the nested action resolves to
  508db95dd578ae2727ebd6217d5ba78e4fbda05d.
• Reviewed the generated bundle, human-readable source, lockfile churn, npm
  integrity metadata, provenance, and advisories. Changed registry artifacts
  retain canonical sources and SHA-512 integrity, with no new install hooks,
  binaries, native code, telemetry, credential harvesting, or unexpected
  network/process behavior.
• This is security-relevant: the bundled tar moves from 7.5.17 to 7.5.21,
  clearing CVE-2026-59871, CVE-2026-59873, CVE-2026-59874, and CVE-2026-73566.
  The source changes contain the corresponding parser, size, recursion, and
  decompression hardening.

Compatibility verification

• npm ci — passed
• npm run lint — passed
• npm run test:once — passed (34 files, 233 tests)
• npm run build — passed
• npm run build-storybook — passed
• The River UI amd64/arm64 image jobs exercised the updated action's
  push-to-registry: true path successfully. The Go matrix, JavaScript checks,
  lint, release, and public image workflow are green.
• The River Pro image failure occurs earlier, while Dependabot attempts to
  assume the private AWS role; its paired job is cancelled. It does not reach
  the changed attestation step and is an unavailable bot-authored check rather
  than a regression caused by this update.

Residual risk

• Low: River references an immutable release tag rather than a full commit SHA,
  and the generated bundle was inspected with source maps rather than rebuilt.
  The unexercised River Pro push-to-registry: false path is covered by the
  same reviewed wrapper and upstream source but cannot run in Dependabot's
  restricted credential context.