[dajiaohuang]

Problem

With the documented keyless signing configuration (keyless: true, no sign-key) and report-artifact: true (the default), the action invokes the CLI with --keyless and --output-signed-prov, but uploads only the unsigned provenance. The signed provenance artifact upload currently requires a nonempty sign-key, so the keyless signature output is missing from the downloadable workflow artifacts.

Change

Include keyless signing in the existing signed-artifact upload condition. Key-based signing, unsigned generation, and report-artifact: false retain their behavior. Rebuild attest/dist/index.js and add dependency-free entry-point fixture tests, runnable with cd attest && npm test.

This fixes an output-artifact omission; it does not change signing, verification, or acceptance of signatures.

Validation

• Entry-point regression on the base: 3 passed, 1 failed (keyless expected two artifact uploads, observed one).
• Fixed entry-point regressions: 4/4 passed (keyless, keyed/custom outputs, unsigned, artifact reporting disabled).
• Existing SBOM suite: 41/41 passed.
• Isolated main/post runner fixture: passed, with synthetic process, filesystem, network, and artifact boundaries.
• Locked npm ci --ignore-scripts --no-audit --no-fund and ncc 0.38.4 rebuild: passed. Generated bundle has the matching one-line condition change.
• git diff --check: passed.

Local checks used Node 24.14.1 on Windows; VM Modules emits its experimental warning. Node20, real Cimon/signing services, GitHub artifact uploads, GHES, and multi-OS end-to-end execution were not tested locally. No live monitoring, secrets, or workflow dispatch was used for the fixture tests.