From 9bec9f380237744af1b4c989ece298ed6b2b77cb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 12:06:20 +0000
Subject: [PATCH] deps(deps): bump actions/attest

Bumps [actions/attest](https://github.com/actions/attest) from 281a49d4cbb0a72c9575a50d18f6deb515a11deb to 59d89421af93a897026c735860bf21b6eb4f7b26.
- [Release notes](https://github.com/actions/attest/releases)
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest/compare/281a49d4cbb0a72c9575a50d18f6deb515a11deb...59d89421af93a897026c735860bf21b6eb4f7b26)

---
updated-dependencies:
- dependency-name: actions/attest
  dependency-version: 59d89421af93a897026c735860bf21b6eb4f7b26
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1f30b7..7e7ad8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,32 +138,32 @@ jobs:
 
       - name: Attest Chrome package
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-path: ScriptVault-v${{ steps.package.outputs.version }}.zip
 
       - name: Attest SBOM
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-path: ScriptVault-v${{ steps.package.outputs.version }}.zip
           sbom-path: release-artifacts/ScriptVault-v${{ steps.package.outputs.version }}.sbom.cyclonedx.json
 
       - name: Attest Firefox package
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-path: firefox-artifacts/scriptvault-firefox-v${{ steps.package.outputs.version }}.zip
 
       - name: Attest Firefox source
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-path: firefox-artifacts/scriptvault-firefox-source-v${{ steps.package.outputs.version }}.zip
 
       - name: Attest Edge package
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-path: edge-artifacts/scriptvault-edge-v${{ steps.package.outputs.version }}.zip