Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 3f368ebe08..dcc7a42ca2 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -33,7 +33,7 @@ jobs:
       id-token: write
       contents: write
     # Can't pin with hash due to how this workflow works.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.7.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
     with:
       base64-subjects: ${{ needs.build.outputs.hash }}
   create-release:

Bumps [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) from 1.7.0 to 1.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/slsa-framework/slsa-github-generator/releases">slsa-framework/slsa-github-generator's releases</a>.</em></p>
<blockquote>
<h2>v1.9.0</h2>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md">CHANGELOG</a> for details.</p>
<h2>v1.9.0-rc.0</h2>
<p><strong>This is an un-finalized pre-release.</strong></p>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md">CHANGELOG</a> for details.</p>
<h2>v1.8.0</h2>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v180">CHANGELOG</a> for details.</p>
<h2>v1.8.0-rc.2</h2>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md">CHANGELOG</a> for details.</p>
<h2>v1.8.0-rc.1</h2>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md">CHANGELOG</a> for details.</p>
<h2>v1.8.0-rc.0</h2>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md">CHANGELOG</a> for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md">slsa-framework/slsa-github-generator's changelog</a>.</em></p>
<blockquote>
<h2>v1.9.0</h2>
<p>Release [v1.9.0] includes bug fixes and new features.</p>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0">full change list</a>.</p>
<h3>v1.9.0: BYOB framework (beta)</h3>
<ul>
<li><strong>New</strong>: A <a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md">new framework</a> to turn GitHub Actions into SLSA compliant builders.</li>
</ul>
<h3>v1.9.0: Maven builder (beta)</h3>
<ul>
<li><strong>New</strong>: A <a href="https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/maven">Maven builder</a> to build Java projects and publish to Maven central.</li>
</ul>
<h3>v1.9.0: Gradle builder (beta)</h3>
<ul>
<li><strong>New</strong>: A <a href="https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/gradle">Gradle builder</a> to build Java projects and publish to Maven central.</li>
</ul>
<h3>v1.9.0: JReleaser builder</h3>
<ul>
<li><strong>New</strong>: A <a href="https://github.com/jreleaser/release-action/tree/v1.0.0-java">JReleaser builder</a> that wraps the official <a href="https://github.com/jreleaser/release-action/tree/v1.0.0-java">JReleaser Action</a>.</li>
</ul>
<h2>v1.8.0</h2>
<p>Release [v1.8.0] includes bug fixes and new features.</p>
<p>See the <a href="https://github.com/slsa-framework/slsa-github-generator/compare/v1.7.0...v1.8.0">full change list</a>.</p>
<h3>v1.8.0: Generic Generator</h3>
<ul>
<li><strong>Added</strong>: A new
<a href="https://github.com/slsa-framework/slsa-github-generator/blob/v1.8.0/internal/builders/generic/README.md#workflow-inputs"><code>base64-subjects-as-file</code></a>
was added to allow for specifying a large subject list.</li>
</ul>
<h3>v1.8.0: Node.js Builder (beta)</h3>
<ul>
<li><strong>Fixed</strong>: Publishing for non-scoped packages was fixed (See
<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2359">#2359</a>)</li>
<li><strong>Fixed</strong>: Documentation was updated to clarify that the GitHub Actions
<code>deployment</code> event is not supported.</li>
<li><strong>Changed</strong>: The file extension for the generated provenance file was changed
from <code>.sigstore</code> to <code>.build.slsa</code> in order to make it easier to identify
provenance files regardless of file format.</li>
<li><strong>Fixed</strong>: The publish action was fixed to address an issue with the package
name when using Node 16.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/07e64b653f10a80b6510f4568f685f8b7b9ea830"><code>07e64b6</code></a> chore: v1.9.0 ref updates (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2673">#2673</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/9bc0d59bb73add013a8982b76767b428491524a7"><code>9bc0d59</code></a> chore: v1.9.0-rc.0 (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2669">#2669</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/72aeffddb180dc2b7ad16c4578f263f20ccac773"><code>72aeffd</code></a> fix: typo in maven builder (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2668">#2668</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/b6d7cbf16d3703646612f15dddf69869f0479457"><code>b6d7cbf</code></a> chore: make build dirs of java builders unique (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2665">#2665</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/7e31fad1e6c846162e8b794a6ca0d04417a17e0d"><code>7e31fad</code></a> docs: v1.9.0-rc.0 changelogs (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2648">#2648</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/5952cf4439308e9d5efb54a4b814d02fb1c9626b"><code>5952cf4</code></a> docs: Update BYOB versions in docs (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2647">#2647</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/da5bdc7cd7ddb0a53ea3e22683ce3302a79928bb"><code>da5bdc7</code></a> chore: fix wrong output in gradle builder (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2646">#2646</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/180a89c64d423565407a13e7bef4e933b50e51cc"><code>180a89c</code></a> chore: fix nits in Gradle builder (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2645">#2645</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/f89a0f4d6b7420e70a20742834490633e2e414b1"><code>f89a0f4</code></a> feat: update Gradle builder to accomodate for e2e test (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2636">#2636</a>)</li>
<li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/324ff12a1e3b69d9c9f586a51b8bf3f2c8067109"><code>324ff12</code></a> feat: Add directory input to Maven builder (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/2538">#2538</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/slsa-framework/slsa-github-generator/compare/v1.7.0...v1.9.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=slsa-framework/slsa-github-generator&package-manager=github_actions&previous-version=1.7.0&new-version=1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>