make sure to populate outputs of the composite action, Disable attestations

action.yml

@@ -15,10 +15,13 @@ inputs:
 outputs:
   package-url:
     description: 'The name of package published to GHCR along with semver. For example, https://ghcr.io/actions/package-action:1.0.1'
+    value: ${{steps.publish.outputs.package-url}}
   package-manifest:
     description: 'The package manifest of the published package in JSON format'
+    value: ${{steps.publish.outputs.package-manifest}}
   package-manifest-sha:
     description: 'A sha256 hash of the package manifest'
+    value: ${{steps.publish.outputs.package-manifest-sha}}
 runs:
   using: 'composite'
   steps:
@@ -36,10 +39,10 @@ runs:
         echo "package manifest sha": ${{steps.publish.outputs.package-manifest-sha}}
         echo "package url": ${{steps.publish.outputs.package-url}}
         echo "subject name": ${{github.repository}}_${{github.ref}}
-    - name: Generate Provenance Attestation
-      uses: github-early-access/generate-build-provenance@main
-      id: build-provenance
-      with:
-        subject-name: ${{github.repository}}_${{github.ref}}
-        subject-digest: ${{steps.publish.outputs.package-manifest-sha}}
-        push-to-registry: false
+    # - name: Generate Provenance Attestation
+    #  uses: github-early-access/generate-build-provenance@main
+    #  id: build-provenance
+    #  with:
+    #    subject-name: ${{github.repository}}_${{github.ref}}
+    #    subject-digest: ${{steps.publish.outputs.package-manifest-sha}}
+    #    push-to-registry: false