From 8b320809f24f56678f0ad917688bbc952e585aad Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <mkeeler@launchdarkly.com>
Date: Tue, 31 Mar 2026 21:14:31 +0000
Subject: [PATCH 01/10] ci: use draft releases to support immutable GitHub
 releases

---
 .github/workflows/manual-publish.yml | 38 +++++++++++++++-----
 .github/workflows/release-please.yml | 52 ++++++++++++++++++++++------
 release-please-config.json           |  1 +
 3 files changed, 71 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml
index 5e35e6dd..55175745 100644
--- a/.github/workflows/manual-publish.yml
+++ b/.github/workflows/manual-publish.yml
@@ -6,6 +6,10 @@ on:
         description: "Is this a dry run. If so no package will be published."
         type: boolean
         required: true
+      publish_release:
+        description: "Whether to publish (un-draft) the release after uploading artifacts."
+        type: boolean
+        default: true
 
 jobs:
   build-ruby-gem:
@@ -28,6 +32,7 @@ jobs:
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write
+      attestations: write # Needed for actions/attest.
 
     steps:
       - uses: actions/checkout@v4
@@ -56,15 +61,30 @@ jobs:
         with:
           token: ${{secrets.GITHUB_TOKEN}}
 
-  release-provenance:
-    needs: ["publish"]
+      - name: Generate checksums file
+        if: ${{ !inputs.dry_run }}
+        env:
+          HASHES: ${{ steps.publish.outputs.gem-hash }}
+        run: |
+          echo "$HASHES" | base64 -d > checksums.txt
+
+      - name: Attest build provenance
+        if: ${{ !inputs.dry_run }}
+        uses: actions/attest@v4
+        with:
+          subject-checksums: checksums.txt
 
+  publish-release:
+    needs: ['publish']
+    if: ${{ !inputs.dry_run && inputs.publish_release }}
+    runs-on: ubuntu-latest
     permissions:
-      actions: read
-      id-token: write
       contents: write
-
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.publish.outputs.gem-hash }}"
-      upload-assets: ${{ !inputs.dry_run }}
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >
+          gh release edit "$(gh release list --repo ${{ github.repository }} --limit 1 --json tagName --jq '.[0].tagName')"
+          --repo ${{ github.repository }}
+          --draft=false
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b837f0a4..e2e80097 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -46,9 +46,27 @@ jobs:
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write # Contents and pull-requests are for release-please to make releases.
+      attestations: write # Needed for actions/attest.
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release tag
+        env:
+          TAG_NAME: ${{ needs.release-package.outputs.upload-tag-name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/ref/tags/${TAG_NAME}" >/dev/null 2>&1; then
+            echo "Tag ${TAG_NAME} already exists, skipping creation."
+          else
+            echo "Creating tag ${TAG_NAME}."
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag "${TAG_NAME}"
+            git push origin "${TAG_NAME}"
+          fi
 
       - uses: ./.github/actions/setup
         with:
@@ -72,17 +90,29 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-  release-provenance:
-    needs: ["release-package", "publish"]
-    if: ${{ needs.release-package.outputs.release-created == 'true' }}
+      - name: Generate checksums file
+        env:
+          HASHES: ${{ steps.publish.outputs.gem-hash }}
+        run: |
+          echo "$HASHES" | base64 -d > checksums.txt
 
+      - name: Attest build provenance
+        uses: actions/attest@v4
+        with:
+          subject-checksums: checksums.txt
+
+  publish-release:
+    needs: ['release-package', 'publish']
+    if: ${{ needs.release-package.outputs.release-created == 'true' }}
+    runs-on: ubuntu-latest
     permissions:
-      actions: read
-      id-token: write
       contents: write
-
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.publish.outputs.gem-hash }}"
-      upload-assets: true
-      upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }}
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.release-package.outputs.upload-tag-name }}
+        run: >
+          gh release edit "$TAG_NAME"
+          --repo ${{ github.repository }}
+          --draft=false
diff --git a/release-please-config.json b/release-please-config.json
index a8443c21..799f83fd 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -4,6 +4,7 @@
       "release-type": "ruby",
       "bump-minor-pre-major": true,
       "versioning": "default",
+      "draft": true,
       "include-component-in-tag": false,
       "include-v-in-tag": false,
       "extra-files": ["PROVENANCE.md", "lib/ldclient-rb/version.rb"]

From 018d5ad58a2805165baea937e6b279729662adc1 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Tue, 31 Mar 2026 21:42:16 +0000
Subject: [PATCH 02/10] ci: add force-tag-creation and publish_release option

---
 release-please-config.json | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/release-please-config.json b/release-please-config.json
index 799f83fd..2c60d533 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -5,9 +5,13 @@
       "bump-minor-pre-major": true,
       "versioning": "default",
       "draft": true,
+      "force-tag-creation": true,
       "include-component-in-tag": false,
       "include-v-in-tag": false,
-      "extra-files": ["PROVENANCE.md", "lib/ldclient-rb/version.rb"]
+      "extra-files": [
+        "PROVENANCE.md",
+        "lib/ldclient-rb/version.rb"
+      ]
     }
   }
 }

From f5bcdd8a276d6d6bb6d3a439fa3a8143fbe5deb4 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Tue, 31 Mar 2026 22:06:51 +0000
Subject: [PATCH 03/10] ci: simplify for attestation-only releases (no draft
 needed)

Since actions/attest@v4 stores attestations via GitHub's attestation API
(not as release assets), repos that only use attestation don't need draft
releases. Release-please can publish the release directly.

Changes:
- Remove draft:true from release-please-config.json
- Remove create-tag job/steps (force-tag-creation handles this)
- Remove publish-release job (release is published directly)
- Remove publish_release input from manual workflows
---
 .github/workflows/manual-publish.yml | 19 -----------------
 .github/workflows/release-please.yml | 31 ----------------------------
 release-please-config.json           |  1 -
 3 files changed, 51 deletions(-)

diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml
index 55175745..b3fa695e 100644
--- a/.github/workflows/manual-publish.yml
+++ b/.github/workflows/manual-publish.yml
@@ -6,10 +6,6 @@ on:
         description: "Is this a dry run. If so no package will be published."
         type: boolean
         required: true
-      publish_release:
-        description: "Whether to publish (un-draft) the release after uploading artifacts."
-        type: boolean
-        default: true
 
 jobs:
   build-ruby-gem:
@@ -73,18 +69,3 @@ jobs:
         uses: actions/attest@v4
         with:
           subject-checksums: checksums.txt
-
-  publish-release:
-    needs: ['publish']
-    if: ${{ !inputs.dry_run && inputs.publish_release }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: >
-          gh release edit "$(gh release list --repo ${{ github.repository }} --limit 1 --json tagName --jq '.[0].tagName')"
-          --repo ${{ github.repository }}
-          --draft=false
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e2e80097..2c957928 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -53,21 +53,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Create release tag
-        env:
-          TAG_NAME: ${{ needs.release-package.outputs.upload-tag-name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if gh api "repos/${{ github.repository }}/git/ref/tags/${TAG_NAME}" >/dev/null 2>&1; then
-            echo "Tag ${TAG_NAME} already exists, skipping creation."
-          else
-            echo "Creating tag ${TAG_NAME}."
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git tag "${TAG_NAME}"
-            git push origin "${TAG_NAME}"
-          fi
-
       - uses: ./.github/actions/setup
         with:
           version: "3.2"
@@ -100,19 +85,3 @@ jobs:
         uses: actions/attest@v4
         with:
           subject-checksums: checksums.txt
-
-  publish-release:
-    needs: ['release-package', 'publish']
-    if: ${{ needs.release-package.outputs.release-created == 'true' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Publish release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG_NAME: ${{ needs.release-package.outputs.upload-tag-name }}
-        run: >
-          gh release edit "$TAG_NAME"
-          --repo ${{ github.repository }}
-          --draft=false
diff --git a/release-please-config.json b/release-please-config.json
index 2c60d533..5fa63fa1 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -4,7 +4,6 @@
       "release-type": "ruby",
       "bump-minor-pre-major": true,
       "versioning": "default",
-      "draft": true,
       "force-tag-creation": true,
       "include-component-in-tag": false,
       "include-v-in-tag": false,

From 7f18cba33c3d74ba84e604dfb4a43aadaa67bd98 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Tue, 31 Mar 2026 22:33:43 +0000
Subject: [PATCH 04/10] ci: remove force-tag-creation from attestation-only
 repo

force-tag-creation only operates in conjunction with draft releases.
Since this repo does not use draft releases (attestation-only, no
artifact uploads to the release), force-tag-creation is not needed.
---
 release-please-config.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/release-please-config.json b/release-please-config.json
index 5fa63fa1..c94b6006 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -4,7 +4,6 @@
       "release-type": "ruby",
       "bump-minor-pre-major": true,
       "versioning": "default",
-      "force-tag-creation": true,
       "include-component-in-tag": false,
       "include-v-in-tag": false,
       "extra-files": [

From 8418a33737171334e25a8dcec833b066e880b4ea Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Tue, 31 Mar 2026 23:12:16 +0000
Subject: [PATCH 05/10] ci: switch from subject-checksums to subject-path for
 attestation

---
 .github/actions/publish/action.yml   | 10 ----------
 .github/workflows/manual-publish.yml | 12 +-----------
 .github/workflows/release-please.yml | 11 +----------
 3 files changed, 2 insertions(+), 31 deletions(-)

diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
index 5cac9939..3d402cde 100644
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@@ -4,10 +4,6 @@ inputs:
   dry_run:
     description: 'Is this a dry run. If so no package will be published.'
     required: true
-outputs:
-  gem-hash:
-    description: "base64-encoded sha256 hashes of distribution files"
-    value: ${{ steps.gem-hash.outputs.gem-hash }}
 
 runs:
   using: composite
@@ -17,12 +13,6 @@ runs:
         pattern: 'gems-*'
         merge-multiple: true
 
-    - name: Hash gem for provenance
-      id: gem-hash
-      shell: bash
-      run: |
-        echo "gem-hash=$(sha256sum launchdarkly-server-sdk-*.gem | base64 -w0)" >> "$GITHUB_OUTPUT"
-
     - name: Publish Library
       shell: bash
       if: ${{ inputs.dry_run == 'false' }}
diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml
index b3fa695e..9d0b1a24 100644
--- a/.github/workflows/manual-publish.yml
+++ b/.github/workflows/manual-publish.yml
@@ -22,9 +22,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: ["build-ruby-gem", "build-jruby-gem"]
 
-    outputs:
-      gem-hash: ${{ steps.publish.outputs.gem-hash }}
-
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write
@@ -57,15 +54,8 @@ jobs:
         with:
           token: ${{secrets.GITHUB_TOKEN}}
 
-      - name: Generate checksums file
-        if: ${{ !inputs.dry_run }}
-        env:
-          HASHES: ${{ steps.publish.outputs.gem-hash }}
-        run: |
-          echo "$HASHES" | base64 -d > checksums.txt
-
       - name: Attest build provenance
         if: ${{ !inputs.dry_run }}
         uses: actions/attest@v4
         with:
-          subject-checksums: checksums.txt
+          subject-path: 'launchdarkly-server-sdk-*.gem'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 2c957928..68b0a8b3 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -40,9 +40,6 @@ jobs:
     needs: ["release-package", "build-ruby-gem", "build-jruby-gem"]
     if: ${{ needs.release-package.outputs.release-created == 'true' }}
 
-    outputs:
-      gem-hash: ${{ steps.publish.outputs.gem-hash }}
-
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write # Contents and pull-requests are for release-please to make releases.
@@ -75,13 +72,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Generate checksums file
-        env:
-          HASHES: ${{ steps.publish.outputs.gem-hash }}
-        run: |
-          echo "$HASHES" | base64 -d > checksums.txt
-
       - name: Attest build provenance
         uses: actions/attest@v4
         with:
-          subject-checksums: checksums.txt
+          subject-path: 'launchdarkly-server-sdk-*.gem'

From 0dd930e876e17effb78c5f2985701f83c36a08be Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Wed, 1 Apr 2026 16:34:30 +0000
Subject: [PATCH 06/10] ci: remove orphaned upload-tag-name job output

---
 .github/workflows/release-please.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 68b0a8b3..8e63ce3a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,6 @@ jobs:
 
     outputs:
       release-created: ${{ steps.release.outputs.release_created }}
-      upload-tag-name: ${{ steps.release.outputs.tag_name }}
 
     steps:
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0

From b0b88a4f90a16aa02d30cef13ec38bfda6b4cf53 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Wed, 1 Apr 2026 18:34:22 +0000
Subject: [PATCH 07/10] ci: remove unnecessary fetch-depth: 0

---
 .github/workflows/release-please.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 8e63ce3a..0f42435a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -46,8 +46,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - uses: ./.github/actions/setup
         with:

From 609b876f9e091f7c31b0f954d15ccb973e64e0c4 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Wed, 1 Apr 2026 19:08:03 +0000
Subject: [PATCH 08/10] ci: use format() for dry_run conditions to handle both
 string and boolean inputs

---
 .github/workflows/manual-publish.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml
index 9d0b1a24..fd02275a 100644
--- a/.github/workflows/manual-publish.yml
+++ b/.github/workflows/manual-publish.yml
@@ -37,7 +37,7 @@ jobs:
 
       - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
         name: "Get rubygems API key"
-        if: ${{ !inputs.dry_run }}
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
         with:
           aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
           ssm_parameter_pairs: "/production/common/releasing/rubygems/api_key = GEM_HOST_API_KEY"
@@ -50,12 +50,12 @@ jobs:
           dry_run: ${{ inputs.dry_run }}
 
       - uses: ./.github/actions/publish-docs
-        if: ${{ !inputs.dry_run }}
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
         with:
           token: ${{secrets.GITHUB_TOKEN}}
 
       - name: Attest build provenance
-        if: ${{ !inputs.dry_run }}
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
         uses: actions/attest@v4
         with:
           subject-path: 'launchdarkly-server-sdk-*.gem'

From 97372201b74d33fa9cfa203be1d4c6f240c00487 Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Wed, 1 Apr 2026 21:49:42 +0000
Subject: [PATCH 09/10] docs: update PROVENANCE.md and README.md for GitHub
 artifact attestations

---
 PROVENANCE.md | 44 +++++++++++++++++++++++++-------------------
 README.md     |  4 ++--
 2 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/PROVENANCE.md b/PROVENANCE.md
index b58621ec..6c07c370 100644
--- a/PROVENANCE.md
+++ b/PROVENANCE.md
@@ -1,10 +1,10 @@
-## Verifying SDK build provenance with the SLSA framework
+## Verifying SDK build provenance with GitHub artifact attestations
 
-LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.
+LaunchDarkly uses [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.
 
-As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple-provenance.intoto.jsonl`.
+LaunchDarkly publishes provenance about our SDK package builds using [GitHub's `actions/attest` action](https://github.com/actions/attest). These attestations are stored in GitHub's attestation API and can be verified using the [GitHub CLI](https://cli.github.com/).
 
-To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below:
+To verify build provenance attestations, we recommend using the [GitHub CLI `attestation verify` command](https://cli.github.com/manual/gh_attestation_verify). Example usage for verifying SDK packages is included below:
 
 <!-- x-release-please-start-version -->
 ```
@@ -17,27 +17,33 @@ SDK_VERSION=8.13.0
 # Download gem
 $ gem fetch launchdarkly-server-sdk -v $SDK_VERSION
 
-# Download provenance from Github release
-$ curl --location -O \
-  https://github.com/launchdarkly/ruby-server-sdk/releases/download/${SDK_VERSION}/launchdarkly-server-sdk-${SDK_VERSION}.gem.intoto.jsonl
-
-# Run slsa-verifier to verify provenance against package artifacts 
-$ slsa-verifier verify-artifact \
---provenance-path launchdarkly-server-sdk-${SDK_VERSION}.gem.intoto.jsonl \
---source-uri github.com/launchdarkly/ruby-server-sdk \
-launchdarkly-server-sdk-${SDK_VERSION}.gem
+# Verify provenance using the GitHub CLI
+$ gh attestation verify launchdarkly-server-sdk-${SDK_VERSION}.gem --owner launchdarkly
 ```
 
 Below is a sample of expected output.
 
 ```
-Verified signature against tlog entry index 78214752 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77ab941c118ef7e0b2d656b962a0d670c6ac91cfa37d07b7b121ae560b00a978ecf
-Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.7.0" at commit f43b3ad834103fdc282652efbfe4963e8dfa737b
-Verifying artifact launchdarkly-server-sdk-8.3.0.gem: PASSED
+Loaded digest sha256:... for file://launchdarkly-server-sdk-8.13.0.gem
+Loaded 1 attestation from GitHub API
+
+The following policy criteria will be enforced:
+- Predicate type must match:................ https://slsa.dev/provenance/v1
+- Source Repository Owner URI must match:... https://github.com/launchdarkly
+- Subject Alternative Name must match regex: (?i)^https://github.com/launchdarkly/
+- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
+
+✓ Verification succeeded!
+
+The following 1 attestation matched the policy criteria
 
-PASSED: Verified SLSA provenance
+- Attestation #1
+  - Build repo:..... launchdarkly/ruby-server-sdk
+  - Build workflow:. .github/workflows/release-please.yml
+  - Signer repo:.... launchdarkly/ruby-server-sdk
+  - Signer workflow: .github/workflows/release-please.yml
 ```
 
-Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation.
+For more information, see [GitHub's documentation on verifying artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli).
 
-**Note:** These instructions do not apply when building our SDKs from source. 
+**Note:** These instructions do not apply when building our SDKs from source.  
diff --git a/README.md b/README.md
index 25ded85e..28b58e80 100644
--- a/README.md
+++ b/README.md
@@ -40,10 +40,10 @@ Contributing
  
 We encourage pull requests and other contributions from the community. Check out our [contributing guidelines](CONTRIBUTING.md) for instructions on how to contribute to this SDK.
 
-Verifying SDK build provenance with the SLSA framework
+Verifying SDK build provenance with GitHub artifact attestations
 ------------
 
-LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md). 
+LaunchDarkly uses [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md).
 
 About LaunchDarkly
 -----------

From 7b710fa39906c4a41426a8eb41e34da357f3640d Mon Sep 17 00:00:00 2001
From: "mkeeler@launchdarkly.com" <keelerm84@gmail.com>
Date: Wed, 1 Apr 2026 22:11:40 +0000
Subject: [PATCH 10/10] docs: restore original SLSA framework text in README.md

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 28b58e80..20ff5d72 100644
--- a/README.md
+++ b/README.md
@@ -40,10 +40,10 @@ Contributing
  
 We encourage pull requests and other contributions from the community. Check out our [contributing guidelines](CONTRIBUTING.md) for instructions on how to contribute to this SDK.
 
-Verifying SDK build provenance with GitHub artifact attestations
+Verifying SDK build provenance with the SLSA framework
 ------------
 
-LaunchDarkly uses [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md).
+LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md).
 
 About LaunchDarkly
 -----------