chore: add build provenance workflow

[nir-test-ac]

✏️ Changes

This pull request adds a security hardening workflow from the unified-pipeline-template (https://github.com/atko-cic/unified-pipeline-template/security). No functional changes are introduced.

Build Provenance

This PR adds .github/workflows/provenance.yml from the unified-pipeline-template.

⚠️ Before merging, review the added .github/workflows/provenance.yml and make the changes described below, plus any other adjustments your CI environment requires.

📦 Publishing to the npm registry? Do not use actions/attest-build-provenance for npm-registry provenance (the npmjs.com badge). Instead, run npm publish --provenance (npm ≥ 9.5.0, GitHub-hosted runner, id-token: write, and a repository field in package.json that matches case-sensitively). For a package's first publish, also add --access public: npm publish --provenance --access public. The npm CLI generates and signs provenance directly to the registry; attest-build-provenance only produces a GitHub-side attestation.

If this repo only builds and publishes an npm package and already runs npm publish --provenance, build provenance is fully covered — close and discard this PR.

⚠️ Required before attestation is meaningful — the build must happen in this job:

1. Build & pass: replace the Build artifact placeholder step with your real build command so the artifact exists on disk before the Attest build provenance step runs, then set subject-path to that artifact.
2. Adapt into your existing build job: move the Attest build provenance step into the job that already builds and publishes your artifact — provenance must live in the same job that produces it. Attesting from a separate job would be a false supply-chain claim.

Optionally, add an upload-artifact step after attestation to pass the attested artifact to downstream jobs or release assets.

Placeholders to fill in before merging

Placeholder	Description
echo "Replace this step with your build command"	Replace with your real build command (e.g. go build, mvn package, npm run build) — the artifact must exist on disk before the attestation step
path/to/your/artifact	Set subject-path to the concrete path (or glob) of the built artifact to attest

🔮 Type of Change

• Standard

🔗 References

https://auth0team.atlassian.net/browse/SEPIO-1674

• I added at least one link (task, slack thread, etc) to explain why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 10f73cee-d918-40a7-9dbd-0f64a046323f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}