ci: bump actions/attest-build-provenance from 3.2.0 to 4.0.0

[dependabot]

Bumps actions/attest-build-provenance from 3.2.0 to 4.0.0.

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Prepare v4 release by @​bdehamer in actions/attest-build-provenance#835

Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0

Commits

• e4d4f7c prepare v4 release (#835)
• 02a49bd Bump github/codeql-action in the actions-minor group (#824)
• 7c757df Bump the npm-development group with 2 updates (#825)
• c44148e Bump github/codeql-action in the actions-minor group (#818)
• 3234352 Bump @​types/node from 25.0.10 to 25.2.0 in the npm-development group (#819)
• 18db129 Bump tar from 7.5.6 to 7.5.7 (#816)
• 90fadfa Bump @​actions/core from 2.0.1 to 2.0.2 in the npm-production group (#799)
• 57db8ba Bump the npm-development group across 1 directory with 3 updates (#808)
• c4c3d11 Bump @​actions/attest from 2.1.0 to 2.2.0 (#800)
• 55d56c3 Bump tar from 7.5.2 to 7.5.6 (#809)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

authentik FIPS Image build status - debian-fips (``)

Image built: ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-debian
full=ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-118
### Debian version ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-118 \
	cat /etc/debian_version
13.3
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-debian:trixie-slim-fips-pr-118 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.4
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.4
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active

[github-actions]

authentik FIPS Image build status - xmlsec1-fips (``)

Image built: ghcr.io/goauthentik/fips-xmlsec1:1.3.9-slim-trixie-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-xmlsec1
full=ghcr.io/goauthentik/fips-xmlsec1:1.3.9-slim-trixie-fips-pr-118
### Test that base images has OpenSSL with FIPS enabled ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.9-slim-trixie-fips-pr-118 \
	openssl list -providers -provider default -provider base -provider fips
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.4
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.4
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
### xmlsec1 version ###
docker run --rm ghcr.io/goauthentik/fips-xmlsec1:1.3.9-slim-trixie-fips-pr-118 \
	xmlsec1 --version
xmlsec1 1.3.9 (openssl)

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.15.0a2)

Image built: ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-118
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-118 \
	python --version
Python 3.15.0a2
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.15.0a2-slim-trixie-fips-pr-118 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.4+ak-fips 30 Sep 2025

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.14.3)

Image built: ghcr.io/goauthentik/fips-python:3.14.3-slim-trixie-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.14.3-slim-trixie-fips-pr-118
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.3-slim-trixie-fips-pr-118 \
	python --version
Python 3.14.3
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.14.3-slim-trixie-fips-pr-118 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.4+ak-fips 30 Sep 2025

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.12.12)

Image built: ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-118
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-118 \
	python --version
Python 3.12.12
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.12.12-slim-trixie-fips-pr-118 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.4+ak-fips 30 Sep 2025

[github-actions]

authentik FIPS Image build status - python-fips (PYTHON_VERSION=3.13.9)

Image built: ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-118 for commit ce2edd0bccb0063278da796e0fb8c979b39dd353

Test output:

image=ghcr.io/goauthentik/fips-python
full=ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-118
### Python version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-118 \
	python --version
Python 3.13.9
### Python SSL version ###
docker run --rm ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips-pr-118 \
	python -c "from ssl import OPENSSL_VERSION; print(OPENSSL_VERSION)"
OpenSSL 3.5.4+ak-fips 30 Sep 2025