Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

N/A — CI-only and documentation changes, no application code or tests affected.

Related issues

Supports the org-wide migration to immutable GitHub releases. Once immutable releases are enabled, artifacts can no longer be uploaded after a release is published. This repo only uses attestation (no binary/artifact uploads to the release), so actions/attest@v4 — which stores attestations via GitHub's attestation API rather than as release assets — is compatible with immutable releases without needing draft releases.

Describe the solution you've provided

Changes across six files:

1. release-please-config.json — Reformatted extra-files array to multi-line (no functional change).

2. .github/actions/publish/action.yml — Removed the gem-hash output and "Hash gem for provenance" step. These existed to produce base64-encoded checksums for the old SLSA generator and are no longer needed since attestation now uses subject-path directly.

3. .github/workflows/release-please.yml — In the publish job:

   • Replaced the separate release-provenance job (SLSA generator_generic_slsa3 reusable workflow with upload-assets: true) with an inline actions/attest@v4 step using subject-path: 'launchdarkly-server-sdk-*.gem'.
   • Added attestations: write permission.
   • Removed gem-hash from job outputs.
   • Removed orphaned upload-tag-name output (was only consumed by the now-removed release-provenance job). The release-created output is retained as it is still used by downstream jobs.

4. .github/workflows/manual-publish.yml — Same attestation migration:

   • Replaced the separate release-provenance job with an inline actions/attest@v4 step using subject-path gated on dry_run check.
   • Added attestations: write permission.
   • Removed gem-hash from job outputs.
   • All dry_run conditions updated to use format('{0}', inputs.dry_run) == 'false' instead of !inputs.dry_run (see note below).

5. PROVENANCE.md — Rewritten to document the new gh attestation verify workflow instead of the old slsa-verifier approach. Includes updated verification commands and sample output matching the new GitHub attestation API format.

6. README.md — Minor whitespace cleanup in the provenance section; the original SLSA framework text is preserved verbatim with a link to PROVENANCE.md for GitHub-specific details.

Why subject-path instead of subject-checksums?

The previous approach used a base64 encode/decode round-trip inherited from the old SLSA generator: the composite action hashed artifacts and base64-encoded the checksums, then the workflow decoded them into a checksums file for actions/attest. Since actions/attest@v4 supports subject-path — which accepts file globs and computes checksums internally — the entire round-trip is eliminated. The glob launchdarkly-server-sdk-*.gem matches the built gem files directly on disk.

Why no draft releases?

The old SLSA generator uploaded .intoto.jsonl provenance files as release assets (via upload-assets: true), which would fail under immutable releases. The new actions/attest@v4 stores attestations via GitHub's attestation API instead — it does not modify the GitHub release. Since this repo has no other artifact uploads, the release can be published directly by release-please without a draft→publish flow.

Why format('{0}', inputs.dry_run) for dry_run checks?

GitHub Actions passes workflow_dispatch boolean inputs as strings ('true'/'false'), but workflow_call passes them as actual booleans. The expression !inputs.dry_run silently coerces differently depending on the trigger type. Using format('{0}', inputs.dry_run) == 'false' normalizes both cases to a string comparison, ensuring the condition works regardless of how the workflow is invoked.

Describe alternatives you've considered

• subject-checksums: An earlier revision decoded base64 hashes into a checksums file for actions/attest. This worked but was unnecessarily complex since the artifact files are already on disk in the same job.
• Draft release pattern: An earlier revision used draft releases with a publish-release job. Simplified since this repo only uses attestation, not artifact uploads.
• Keep SLSA generator: Could keep it as a separate reusable workflow, but actions/attest@v4 is the org-standard replacement and runs inline without requiring a separate job.
• fromJSON(inputs.dry_run) for boolean coercion: Undocumented behavior when called on an already-boolean value. format() is fully documented for both types.

Additional context

⚠️ Items for reviewer attention:

• dry_run gating correctness: The format('{0}', inputs.dry_run) == 'false' pattern is used in manual-publish.yml for the attestation step, secrets retrieval, and docs publishing. Verify that this evaluates correctly for both workflow_dispatch (string) and workflow_call (boolean) triggers in your environment.
• Glob pattern correctness: The subject-path: 'launchdarkly-server-sdk-*.gem' glob must match all gem files produced by the build (both CRuby and JRuby variants). The existing publish action already uses the same launchdarkly-server-sdk-*.gem glob for gem push, so this should be consistent.
• No if guard on attestation in release-please.yml: The Attest build provenance step runs unconditionally within the publish job (which is itself gated on release-created == 'true'). The manual workflow correctly gates on the dry_run check. Confirm this asymmetry is acceptable.
• PROVENANCE.md version placeholder: The SDK_VERSION=8.13.0 in PROVENANCE.md is managed by release-please via extra-files. Verify that release-please will update this value on the next release.
• Trailing whitespace in PROVENANCE.md: The last line has a trailing double-space that was present before and remains — cosmetic only, but noting for completeness.
• actions/attest@v4 is referenced by major version tag (not pinned SHA), consistent with existing actions/checkout@v4 usage in this repo.

Link to Devin session: https://app.devin.ai/sessions/7d5bda4d9dbe4ae0b950b30a50485e60
Requested by: @keelerm84