fix: provenance build type v2

[bdehamer]

Various updates to the generated provenance statement:

• Removes forgeable provenance fields
• Updates the materials.uri value to include the GITHUB_REF value
• Updates the entryPoint value to include just the repo-relative path to the initiating workflow:
  github/foo/.github/workflows/publish.yml@refs/heads/main → .github/workflows/publish.yml
• Updates the builder.id and buildType fields

[ljharb]

are there tests that explain why this change is needed?

[bdehamer]

@feelepxyz thoughts on this last commit which updates the builder.id and buildType

• builder.id changes from https://github.com/npm/cli@9.4.0 to https://github.com/actions/runner (to be augmented with actual runner type and runner version at some later date)
• buildType remains the same but we increment the version from v1 to v2 and change the "@" to "/" to ensure URI parseability: https://github.com/npm/cli/gha/v2

[wraithgar]

What does a typical GITHUB_WORKFLOW_REF look like?

[bdehamer]

What does a typical GITHUB_WORKFLOW_REF look like?

The raw GITHUB_WORKFLOW_REF looks something like:

github/package-security/.github/workflows/dump-env.yml@refs/heads/main

and we need to extract just the repo-relative workflow path from that:

.github/workflows/dump-env.yml

[bdehamer]

With these changes, the new provenance statement will look something like:

{
  "_type": "https://in-toto.io/Statement/v0.1",
  "subject": [
    {
      "name": "pkg:npm/sigstore@1.0.0",
      "digest": {
        "sha512": "7bea9f6e7ff37f5fab0b36bf061200fff03099fd2fd696b91d04bc5e4f225eb9fd6e0cadcad54ba980f43fb352a99e8810b4e0abeb5c0ef2cf9108cd1f258b36"
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v0.2",
  "predicate": {
    "buildType": "https://github.com/npm/cli/gha/v2",
    "builder": {
      "id": "https://github.com/actions/runner"
    },
    "invocation": {
      "configSource": {
        "uri": "git+https://github.com/sigstore/sigstore-js@refs/tags/v1.0.0",
        "digest": {
          "sha1": "06528997c3c8ab9f864fad9a3658446aca7fd86d"
        },
        "entryPoint": ".github/workflows/publish.yml"
      },
      "parameters": {},
      "environment": {
        "GITHUB_EVENT_NAME": "release",
        "GITHUB_REF": "refs/tags/v1.0.0",
        "GITHUB_REPOSITORY": "sigstore/sigstore-js",
        "GITHUB_REPOSITORY_ID": "495574555",
        "GITHUB_REPOSITORY_OWNER_ID": "71096353",
        "GITHUB_RUN_ATTEMPT": "1",
        "GITHUB_RUN_ID": "4137028816",
        "GITHUB_SHA": "06528997c3c8ab9f864fad9a3658446aca7fd86d",
        "GITHUB_WORKFLOW_REF": "sigstore/sigstore-js/.github/workflows/publish.yml@refs/tags/v1.0.0",
        "GITHUB_WORKFLOW_SHA": "06528997c3c8ab9f864fad9a3658446aca7fd86d"
      }
    },
    "metadata": {
      "buildInvocationId": "4137028816-1",
      "completeness": {
        "parameters": false,
        "environment": false,
        "materials": false
      },
      "reproducible": false
    },
    "materials": [
      {
        "uri": "git+https://github.com/sigstore/sigstore-js@refs/tags/v1.0.0",
        "digest": {
          "sha1": "06528997c3c8ab9f864fad9a3658446aca7fd86d"
        }
      }
    ]
  }
}

[feelepxyz]

Minor spec copy, otherwise LGTM 👍