⬆️ ci: Bump actions/upload-artifact from 4 to 7#3
Closed
dependabot[bot] wants to merge 128 commits into
Closed
Conversation
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Refactored Evolution API monitoring into discrete hooks (data, actions, notifications, types), added advanced health logs filtering, enhanced connections with QR/reconnect, expanded timeline with events, and implemented diagnostic export/reporting. Includes new SLA/heatmap groundwork and updated dashboards to consume new hooks. X-Lovable-Edit-ID: edt-45d011e7-7797-4a72-a177-163d22be5b7f Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Implemented new MonitoringSkeletons with StatsCardsSkeleton, ChartSkeleton, TimelineSkeleton, and DashboardSkeleton to replace placeholders during data loading, improving perceived performance and accessibility. X-Lovable-Edit-ID: edt-39e48f88-9423-4a84-91f3-f04d37dc86f6 Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
Introduced MonitoringSkeletons with StatsCardsSkeleton, ChartSkeleton, TimelineSkeleton, and DashboardSkeleton to replace spinners during load, enabling accessibility and smoother UX during data fetches. X-Lovable-Edit-ID: edt-eb3f9529-3ee9-4c00-b5cc-d948974cade6 Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
X-Lovable-Edit-ID: edt-6e079416-cb29-4905-aa73-1087451bf83f Co-authored-by: adm01-debug <231131902+adm01-debug@users.noreply.github.com>
X-Lovable-Edit-ID: edt-aca1189b-e294-49c7-9871-4a8db9c90e18
X-Lovable-Edit-ID: edt-f656120b-3eea-4469-a86d-2764989487e9
X-Lovable-Edit-ID: edt-1dcac431-62ed-4142-9995-3798c92fe167
X-Lovable-Edit-ID: edt-e91eef3d-ac79-4c88-958f-13a01c5cda63
X-Lovable-Edit-ID: edt-cb46f773-e931-4e5f-b78b-cfa87e1affb7
X-Lovable-Edit-ID: edt-fa43af00-1eae-4da9-9ecd-57a42fa6c3e0
X-Lovable-Edit-ID: edt-b5afb85e-c5c2-46b8-9391-63abd42aaa5f
X-Lovable-Edit-ID: edt-88ee4892-7445-49b3-9ff2-65d732d1797b
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughWalkthroughO workflow do GitHub Actions para CI/CD atualiza a ação ChangesAtualização da ação de upload de artefatos do GitHub Actions
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutos Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 75: Ações `uses: actions/upload-artifact@v7` estão sem pin imutável;
substitua ambas as ocorrências do identificador actions/upload-artifact@v7 pelo
commit SHA da release correspondente (por exemplo
actions/upload-artifact@<commit-sha>) para fixar a dependência de supply-chain;
atualize as duas instâncias onde aparece o identificador
actions/upload-artifact@v7 e verifique que o SHA usado corresponde ao commit da
action que você quer travar.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 97247e26-bd19-4bf9-a08e-2820a054eeb2
📒 Files selected for processing (1)
.github/workflows/ci.yml
|
|
||
| - name: 📊 Upload coverage report | ||
| uses: actions/upload-artifact@v4 | ||
| uses: actions/upload-artifact@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verifica SHA alvo do tag v7 (read-only) para pinagem imutável.
set -euo pipefail
repo="actions/upload-artifact"
tag="v7"
echo "Consultando SHA do tag ${tag} em ${repo}..."
curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}" | jq -r '.object.sha'
echo
echo "Se o objeto retornado for tag anotada, resolva o commit final:"
tag_obj_sha=$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}" | jq -r '.object.sha')
curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${tag_obj_sha}" | jq -r '.object.sha // empty'Repository: adm01-debug/zapp-web-v3
Length of output: 296
🏁 Script executed:
wc -l .github/workflows/ci.ymlRepository: adm01-debug/zapp-web-v3
Length of output: 96
🏁 Script executed:
sed -n '70,80p' .github/workflows/ci.yml
sed -n '106,116p' .github/workflows/ci.ymlRepository: adm01-debug/zapp-web-v3
Length of output: 785
🏁 Script executed:
rg 'upload-artifact' .github/workflows/ci.yml -nRepository: adm01-debug/zapp-web-v3
Length of output: 156
Fixar actions/upload-artifact por SHA para reduzir risco de supply-chain.
Nas linhas 75 e 111, uses: actions/upload-artifact@v7 está sem pin imutável e viola a política de unpinned-uses. Use o SHA do commit da action para garantir integridade:
🔧 Exemplo de ajuste
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a(Aplicar a ambas as linhas)
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| uses: actions/upload-artifact@v7 | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 75-75: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 75, Ações `uses:
actions/upload-artifact@v7` estão sem pin imutável; substitua ambas as
ocorrências do identificador actions/upload-artifact@v7 pelo commit SHA da
release correspondente (por exemplo actions/upload-artifact@<commit-sha>) para
fixar a dependência de supply-chain; atualize as duas instâncias onde aparece o
identificador actions/upload-artifact@v7 e verifique que o SHA usado corresponde
ao commit da action que você quer travar.
adm01-debug
added a commit
that referenced
this pull request
May 20, 2026
… completa Corrige gap crítico #3 da auditoria: arquivo era um stub quase vazio. Adiciona: envio, sync, busca local, marcar lido, lixeira, labels, rascunhos, refresh de token, revogação OAuth e registro de Pub/Sub watch.
adm01-debug
added a commit
that referenced
this pull request
May 20, 2026
…etch, ConversationHistory Improvement 3/18: - ContactDuplicateIndicator: Jaro-Winkler cross-channel duplicate detection in chat (Gap #14) - normalizePhoneBR: robust Brazilian phone E.164 normalization with 9th digit (Gap #2) - useContactAvatarFetch: auto-fetch WhatsApp profile picture via Evolution API (Gap #3) - ContactConversationHistory: clickable past conversations list per contact (Gap #7)
adm01-debug
added a commit
that referenced
this pull request
May 20, 2026
…new components Improvement 4/18 — Complete rewrite integrating: - useContactAvatarFetch: auto-fetch WhatsApp profile pics (Gap #3) - ContactInlineEdit: click-to-edit name/email/company (Gap #6) - ContactSLAIndicator: SLA badge in header (Gap #9) - ContactQuickNotePanel: inline timestamped notes (Gap #15) - ContactDuplicateIndicator: cross-channel duplicate alert (Gap #14) - ContactConversationHistory: past conversations in Activity tab (Gap #7) - ContactOrphanState: graceful fallback for null contact (Gap #13) - normalizePhoneBR: proper phone formatting (Gap #2) - Custom fields section (Gap #5) - Loading skeleton state - Full a11y with role/aria attributes
adm01-debug
pushed a commit
that referenced
this pull request
May 20, 2026
P0 críticos:
- P0-1: removido vazamento Lovable em 5 metatags (canonical, og:url,
og:image, twitter:image, JSON-LD url) — agora aponta zapp.atomicabr.com.br
- P0-2: removido dns-prefetch órfãos para api.elevenlabs.io e
ai.gateway.lovable.dev (que NÃO estavam na CSP connect-src);
ambos só são chamados via Supabase Edge Functions
P1 importantes:
- P1-5: removidas meta http-equiv X-Frame-Options e X-Content-Type-Options
(conflitavam com headers HTTP do nginx); segurança vem via header
P2 melhorias:
- P2-2: ícones PNG otimizados (-92.7% no 512x512: 617KB → 45KB,
-61% nos demais); economia total ~1MB no install PWA
- P2-3: sitemap.xml expandido (1 → 3 URLs com lastmod: /, /auth, /install)
- P2-7: apple-touch-icon agora 180x180 corretos (8.7KB, era 109KB
em dimensão errada de 512x512)
Validado: smoke v1 55/55 (A+) + smoke v2 10/10 (todos os fixes)
adm01-debug
deleted the
dependabot/github_actions/actions/upload-artifact-7
branch
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit