[JamBalaya56562]

Part of #4077.
Closes: #4550

This takes over #4550 by @keeltrace, which has been blocked on the Google CLA since 2026-10-01 (one of its commits has an author who hasn't signed it). Thank you, @keeltrace, for the original work!

Attestation.BundleURL was added by #4647 in the meantime, so this PR only contains the parts of #4550 that are not in master yet:

• Mark Attestation.Bundle as deprecated, since GitHub REST API version 2026-03-10 removes the bundle property from attestation list responses.
• Make the verifyartifact example fetch the bundle from bundle_url, falling back to the embedded bundle. github.com already returns "bundle": null, even with API version 2022-11-28, so the example in master panics with a nil pointer dereference.

Changes from #4550:

• The content at bundle_url is snappy-compressed (Content-Type: application/x-snappy), so the example decompresses it with github.com/golang/snappy before unmarshaling it, as gh attestation does. Unmarshaling the downloaded bytes directly, as feat: Support attestation bundle URLs #4550 did, fails with invalid character '\xbc' looking for beginning of value.
• The bundle URL is fetched without the GitHub token.

With this change, running the example with the digest from its usage text (2ce2e480…) prints Verification successful!.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.63%. Comparing base (6eccc42) to head (4755af8).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4681   +/-   ##
=======================================
  Coverage   98.63%   98.63%           
=======================================
  Files         201      201           
  Lines       18951    18951           
=======================================
  Hits        18693    18693           
  Misses        258      258           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gmlewis]

Thank you, @JamBalaya56562!
LGTM.
Awaiting second LGTM+Approval from any other contributor to this repo before merging.

cc: @stevehipwell - @Not-Dhananjay-Mishra

[Not-Dhananjay-Mishra]

LGTM

[gmlewis]

Thank you, @Not-Dhananjay-Mishra!
Merging.