The bundle generated by actions/attest is currently only retrievable via the GitHub attestations API, which requires authentication. Uploading it as jq-attestation.json lets downstream consumers (distro packagers, unauthenticated CI) verify provenance offline.