From e4f5390e5273f46fa564bd07d9948b7ead354ceb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 23:42:35 +0000
Subject: [PATCH 1/4] Add firmware artifact attestations

Agent-Logs-Url: https://github.com/SierraJC/qmk_userspace/sessions/c7ebe4f2-ff38-4735-9c3e-fc74325088be

Co-authored-by: SierraJC <7351311+SierraJC@users.noreply.github.com>
---
 .github/workflows/build_binaries.yaml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build_binaries.yaml b/.github/workflows/build_binaries.yaml
index a6a1b6abf45..0a5fbf77237 100755
--- a/.github/workflows/build_binaries.yaml
+++ b/.github/workflows/build_binaries.yaml
@@ -7,7 +7,9 @@ on:
   workflow_dispatch:
 
 permissions:
+  attestations: write
   contents: write
+  id-token: write
 
 jobs:
   build:
@@ -17,8 +19,28 @@ jobs:
       qmk_repo: vial-kb/vial-qmk
       qmk_ref: vial
 
+  attest:
+    name: 'QMK Userspace Attest'
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs: build
+
+    steps:
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: Firmware
+
+      - name: Attest firmware artifacts
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            *.bin
+            *.hex
+            *.uf2
+
   publish:
     name: 'QMK Userspace Publish'
     uses: qmk/.github/.github/workflows/qmk_userspace_publish.yml@ae0d588378c528a97635c7dc4345fff2a2ff5dac
     if: always() && !cancelled() && github.event_name != 'pull_request'
-    needs: build
+    needs: [build, attest]

From 84aa14f30a423d2a6523c8bd9bd7956cbeb1ac9b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 23:42:58 +0000
Subject: [PATCH 2/4] Limit attestation permissions

Agent-Logs-Url: https://github.com/SierraJC/qmk_userspace/sessions/c7ebe4f2-ff38-4735-9c3e-fc74325088be

Co-authored-by: SierraJC <7351311+SierraJC@users.noreply.github.com>
---
 .github/workflows/build_binaries.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build_binaries.yaml b/.github/workflows/build_binaries.yaml
index 0a5fbf77237..55c3e92ace2 100755
--- a/.github/workflows/build_binaries.yaml
+++ b/.github/workflows/build_binaries.yaml
@@ -7,9 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  attestations: write
   contents: write
-  id-token: write
 
 jobs:
   build:
@@ -24,6 +22,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
     needs: build
+    permissions:
+      actions: read
+      attestations: write
+      contents: read
+      id-token: write
 
     steps:
       - name: Download binaries
@@ -42,5 +45,5 @@ jobs:
   publish:
     name: 'QMK Userspace Publish'
     uses: qmk/.github/.github/workflows/qmk_userspace_publish.yml@ae0d588378c528a97635c7dc4345fff2a2ff5dac
-    if: always() && !cancelled() && github.event_name != 'pull_request'
+    if: needs.attest.result == 'success' && github.event_name != 'pull_request'
     needs: [build, attest]

From 676e68c21ff8724a8c95b796e533cc6d4ff2697c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 23:51:39 +0000
Subject: [PATCH 3/4] Pin new actions to commit SHAs

Agent-Logs-Url: https://github.com/SierraJC/qmk_userspace/sessions/5d352f4e-c262-4249-b01b-1dcfa7aab35d

Co-authored-by: SierraJC <7351311+SierraJC@users.noreply.github.com>
---
 .github/workflows/build_binaries.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_binaries.yaml b/.github/workflows/build_binaries.yaml
index 55c3e92ace2..2b7040020f9 100755
--- a/.github/workflows/build_binaries.yaml
+++ b/.github/workflows/build_binaries.yaml
@@ -30,12 +30,12 @@ jobs:
 
     steps:
       - name: Download binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Firmware
 
       - name: Attest firmware artifacts
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
         with:
           subject-path: |
             *.bin

From 7db3f4eaff771bf1097c07f2ac2840b7fe41347d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 5 May 2026 23:59:04 +0000
Subject: [PATCH 4/4] Update attest-build-provenance pin to latest v4.1.0

Agent-Logs-Url: https://github.com/SierraJC/qmk_userspace/sessions/e49614ab-6f80-451a-bf42-952bf15f2111

Co-authored-by: SierraJC <7351311+SierraJC@users.noreply.github.com>
---
 .github/workflows/build_binaries.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build_binaries.yaml b/.github/workflows/build_binaries.yaml
index 2b7040020f9..70a76add9b1 100755
--- a/.github/workflows/build_binaries.yaml
+++ b/.github/workflows/build_binaries.yaml
@@ -35,7 +35,7 @@ jobs:
           name: Firmware
 
       - name: Attest firmware artifacts
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: |
             *.bin