ci: implement immutable releases support with actions/attest

[keelerm84]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

N/A — CI-only and documentation changes, no application code or tests affected.

Related issues

Supports the org-wide migration to immutable GitHub releases. Reference implementation: launchdarkly/ld-relay (branch v8).

Describe the solution you've provided

GitHub's immutable releases feature prevents modifying a release after it is published. This repo only uses attestation (no binary/artifact uploads to the release), so actions/attest@v4 — which stores attestations via GitHub's attestation API rather than as release assets — is compatible with immutable releases without needing draft releases.

This PR makes the following changes:

1. SLSA → actions/attest@v4 (both workflows): Replaced the separate release-provenance job (using slsa-framework/slsa-github-generator reusable workflow with upload-assets: true) with inline actions/attest@v4 steps within the build job. Attestation now uses subject-path: 'dist/*' to reference the built distribution files directly on disk, eliminating the old base64-encoded hash round-trip entirely.

2. Removed hash outputs from build action: The package-hashes output and "Hash build files for provenance" step were removed from .github/actions/build/action.yml since subject-path reads files directly rather than requiring pre-computed checksums.

3. attestations: write permission: Added to both workflows to support actions/attest@v4.

4. Removed orphaned job outputs from release-please.yml: The release-created, upload-tag-name, and package-hashes outputs were only consumed by the now-removed release-provenance job. All three have been removed.

5. Removed orphaned package-hashes output from manual-publish.yml: Similarly unused after removing the release-provenance job.

6. Updated PROVENANCE.md: Replaced SLSA verifier instructions with gh attestation verify --owner launchdarkly instructions and sample output reflecting GitHub artifact attestations.

7. README.md: The SLSA framework heading and description are preserved verbatim (the GitHub-specific verification details live in PROVENANCE.md). Only a minor trailing-whitespace fix is included.

8. dry_run condition fix: Uses format('{0}', inputs.dry_run) == 'false' to safely handle the boolean/string mismatch between workflow_call (boolean) and workflow_dispatch (string) trigger types.

Key things for reviewer to verify:

• Verify that subject-path: 'dist/*' correctly matches the poetry build output (.tar.gz and .whl files in ./dist/).
• Confirm no external workflows or systems depend on the removed release-created or upload-tag-name job outputs from release-please.yml. These were only consumed by the release-provenance job within this workflow.
• The PROVENANCE.md sample output is based on real gh attestation verify output from ld-relay. The repo/workflow names are adapted for this repo but haven't been verified against an actual attested release yet.
• No draft release configuration or force-tag-creation is needed for this repo since actions/attest@v4 does not upload assets to the GitHub release.

Updates since last revision

• Reverted the split release-please pattern (two-pass skip-github-pull-request / skip-github-release) that was briefly added. That pattern is only needed for repos that upload artifacts to releases (which require draft releases). Since this repo is attestation-only, the standard single-pass release-please is correct.
• Updated PROVENANCE.md to use gh attestation verify --owner launchdarkly with the full real output template (policy criteria, attestation details) instead of a simplified placeholder.
• Removed unused tag input from manual-publish.yml (flagged by Cursor Bugbot as dead code).
• Removed orphaned release-created and upload-tag-name job outputs from release-please.yml.
• Fixed dry_run conditions to use format('{0}', inputs.dry_run) == 'false' for correct boolean/string handling across trigger types.
• Switched attestation from subject-checksums to subject-path: 'dist/*', eliminating the base64 encode/decode round-trip entirely.

Describe alternatives you've considered

An earlier revision used draft releases with a publish-release job to un-draft after completion. This was simplified since this repo only uses attestation (not artifact uploads), so draft releases are unnecessary.

An intermediate revision used subject-checksums with a checksums file (base64 decode of hashes computed in the build action). This was replaced with subject-path since the artifacts are on disk in the same job, making the hash round-trip redundant.

The verify command could use -R launchdarkly/python-server-sdk to scope verification to this specific repo, but --owner launchdarkly was chosen for consistency across all LaunchDarkly SDK repos.

Additional context

No application code or test changes. Only CI workflow files and documentation are modified.

Link to Devin session: https://app.devin.ai/sessions/7d5bda4d9dbe4ae0b950b30a50485e60
Requested by: @keelerm84

---

Note

Medium Risk
Changes the release/publish GitHub Actions workflows and provenance generation, which could impact PyPI publishing or provenance availability if misconfigured, but does not touch runtime SDK code.

Overview
Switches package provenance generation from the SLSA reusable workflow (uploading provenance as release assets) to GitHub Artifact Attestations via actions/attest@v4, attesting directly over dist/*.

Removes the build action’s package-hashes output/hash step and deletes the now-unused workflow outputs and release-provenance jobs; adds attestations: write permissions and fixes dry_run gating in manual-publish.yml. Updates PROVENANCE.md to document verification via gh attestation verify (README only gets minor whitespace/wording cleanup).

^{Reviewed by Cursor Bugbot for commit 376a848. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}