.github/workflows/build-ipk.yml

@@ -124,7 +124,7 @@ jobs:
 
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.ipk

.github/workflows/build-rpm-arm64.yml

@@ -175,7 +175,7 @@ jobs:
        gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.rpm

.github/workflows/build-rpm-armhf.yml

@@ -107,7 +107,7 @@ jobs:
        gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.deb

.github/workflows/build-rpm-x86-64.yml

@@ -176,7 +176,7 @@ jobs:
        gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.rpm

.github/workflows/build-watcom.yml

@@ -106,7 +106,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-lite
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip

.github/workflows/build-win32.yml

@@ -121,7 +121,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x86
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip

.github/workflows/build-win64.yml

@@ -122,7 +122,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip

.github/workflows/build-winarm64.yml

@@ -121,7 +121,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v4
+      uses: actions/attest-build-provenance@v2
       with:
         subject-path: |
           *.zip

.github/workflows/docker.yml

@@ -103,7 +103,7 @@ jobs:
             floating: minimal
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v7
         with:
           path: /tmp/digests
           pattern: digests-${{ matrix.image }}-*
@@ -171,14 +171,14 @@ jobs:
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
 
       - name: Attest Docker Hub image
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@v2
         with:
           subject-name: ${{ env.DOCKERHUB_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}
           push-to-registry: false
 
       - name: Attest GHCR image
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@v2
         with:
           subject-name: ${{ env.GHCR_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}