chore(deps): bump actions/attest-build-provenance from 1 to 4 in the everything group (#44)

* chore(deps): bump actions/attest-build-provenance

Bumps the everything group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/attest-build-provenance` from 1 to 4
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@v1...v4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: everything
...

Signed-off-by: dependabot[bot] <support@github.com>

* feat: add CI workflow for build, tests, and npm publish; remove old Vitest workflow

* fix: update CI workflow name and modify npm publish step to prevent failure

* fix: standardize quotes in npm-publish workflow tag pattern

* fix: remove insecure Node version allowance in npm-publish workflow

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: miichom <hello@cammy.xyz>
Co-authored-by: Cammy <52957759+miichom@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/ci-verify.yml

@@ -0,0 +1,51 @@
+name: CI - Verify
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install node ${{ matrix.node-version }}
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Install dependencies
+        run: npm ci
+      - name: Run tests
+        run: npm test
+      - name: Report Coverage
+        if: always()
+        uses: davelosert/vitest-coverage-report-action@v2
+        with:
+          threshold-icons: "{0: '🔴', 80: '🟠', 90: '🟢'}"
+  verify-publish:
+    runs-on: ubuntu-latest
+    needs: test
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run build
+      - name: Generate provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: dist/**
+      - name: Verify npm publish
+        run: npm publish --provenance --dry-run || true

.github/workflows/ci-vitest.yml

@@ -1,8 +1,10 @@
 name: Publish Package to npmjs
+
 on:
   push:
     tags:
       - "v*"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -20,10 +22,7 @@ jobs:
       - run: npm ci
       - run: npm run build
       - name: Generate provenance
-        uses: actions/attest-build-provenance@v1
-        env:
-          # actions/attest-build-provenance@v1 uses Node 20
-          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: dist/**
       - run: npm publish --provenance --access public