Skip to content

Bump actions/download-artifact from 4 to 8 - #1

Merged
getappz merged 1 commit into
masterfrom
dependabot/github_actions/actions/download-artifact-8
Jul 5, 2026
Merged

Bump actions/download-artifact from 4 to 8#1
getappz merged 1 commit into
masterfrom
dependabot/github_actions/actions/download-artifact-8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 5, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/download-artifact from 4 to 8.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 5, 2026
@getappz
getappz merged commit 1ff5734 into master Jul 5, 2026
4 checks passed
@getappz
getappz deleted the dependabot/github_actions/actions/download-artifact-8 branch July 5, 2026 20:46
getappz added a commit that referenced this pull request Aug 13, 2026
…estration (#472)

* feat(flare-workflow): scaffold crate with typed DAG types + journal + SQLite store

Phase 1-2 of epic #447: core types (StepMode/ErrorMode/JournalEntry with
CompletableEntry invariant), DAG validation, StateStore trait + in-memory,
and SqliteStore on agentflare-db-kit with append-only journal.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(flare-workflow): journaled DAG engine core with retries + event bus

Phase 3 of epic #447: port SMG wfaas engine (DAG parallel scheduler,
backoff retries, RetryIndefinitely, cancellation, graceful shutdown,
event bus) fused with the durable journal — every terminal step result
appended as JournalEntry::StepRun.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(flare-workflow): OpenFang step semantics — conditional/loop/fanout+collect, variables, tokens, eviction

Phase 4 of epic #447: engine executes StepMode variants (Conditional skip,
Loop until/max-iterations, FanOut+Collect join via shared buffer),
string-pipeline input chaining ({{input}} + output_var capture),
token accounting on StepState, run-eviction cap (200), and ErrorMode::Skip
turns terminal failures into skips. OpenFang test suite ported.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(flare-workflow): durable waits — Sleep timers + WaitEvent promises + complete_event

Phase 5 of epic #447: Sleep/WaitEvent journaled (pending + completed
entries, Restate design), in-process oneshot waiters, exactly-once
complete_event with journaled pre-delivery closing the notify-before-wait
race, and TTL timeout path.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(flare-workflow): recovery pass — crash-resume with exactly-once via journal memoization

Phase 6 of epic #447: engine.recover() replays active runs over the SQLite
journal, skips steps with completed entries (StepRun/Sleep/WaitEvent), and
re-drives pending steps; pending Sleep re-arms idempotently; WorkflowDefinition
is now Clone for re-registration. Durable-wait methods split into waits.rs to
stay under the LOC gate. Crash-resume test proves a completed step never
re-executes (exactly-once); racing completions resolve to one winner.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(flare-workflow): OpenFang JSON schema + compile + example workflows

Phase 7 (core) of epic #447: JsonWorkflow schema compiles to engine-ready
definitions with agent-prompt executors dispatching through a caller-supplied
SendMessage hook (input/var templating, token accounting, retryable by
default). OpenFang's four example workflows (code-review, research-and-write
with conditional, brainstorm fan-out+collect, iterative-refinement loop) run
as fixtures. Workspace builds with the new member.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* docs(flare-workflow): crate README — usage, durability, JSON workflows

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* chore: update Cargo.lock for flare-workflow crate

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(workflow): mcp__flare__workflow + agentflare workflow CLI + real pipeline test

Phase 7b: src/workflow.rs service (durable SqliteStore, shared runtime,
headless-agent SendMessage hook) + mcp__flare__workflow (run/status/
complete_event/list) + agentflare workflow CLI. compile_workflow now wires
OpenFang positional ordering into DAG edges (sequential chain, fan-out group
-> collect). complete_event is journal-first so a different engine instance
(MCP/CLI/recovery) resolves a wait. Tests: service round-trips, cross-engine
event resolution, and a REAL coder->reviewer->PR pipeline that performs git/
file work in a temp repo (branch, commit, real-diff review loop, PR ref).

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* feat(workflow): MCP handler tests + async cores for daemon-safe invocation

Phase 7b completion: workflow service exposes async cores (no nested block_on
from the daemon's async runtime) with sync wrappers for the CLI; mcp__flare__workflow
handler tests cover run/status/list + error paths; real coder->reviewer->PR git
flow test proves the engine drives agentflare's item-pipeline mechanics.

Agentflare-Agent: 1
Agentflare-Branch: task/447
Agentflare-Item: 447

* fix(flare-workflow): resolve code-review findings on task/447

Fixes for the 8 review findings on item #447 (all except #8, documented
below):

- agent_send_hook now runs run_headless inside spawn_blocking within
  the async block, instead of synchronously before it (finding #1).
- SqliteStore's StateStore impl wraps every method's rusqlite I/O in
  spawn_blocking so it can't stall an async executor thread (#2).
- WorkflowEngine gains an optional runtime handle
  (with_runtime_handle); start_workflow/recover/start_cleanup_task
  spawn through it. src/workflow.rs now attaches WORKFLOW_RT so the
  MCP path (which awaits the async core directly on the daemon's own
  runtime) also keeps execution off that runtime, not just the CLI's
  block_on path (#3).
- Steps whose dependency failed now get an explicit Skipped status
  (with a cascade to their own dependents) instead of staying stuck at
  Pending forever; completion signals now forward on any terminal
  result, not just Success/Skip, so blocked dependents actually reach
  the scheduler (#4).
- WaitEvent waiters are now keyed per step instance
  (run_id:step_id:name) instead of run_id:name, so two concurrent
  wait_event steps sharing an event name no longer drop each other's
  waiter; complete_event wakes every matching waiter (#5).
- cleanup_old_workflows no longer panics via .expect() on a lock/query
  failure; it logs and returns 0 like its siblings (#6).
- write_state now does targeted UPSERTs of step_state/run_vars rows
  instead of DELETE-all + INSERT-all on every write (#7).

Finding #8 (WorkflowRunId::new() vs db_kit::ids::new_id()) intentionally
left as-is: new_id() returns a nanoid String, but WorkflowRunId wraps a
Uuid and is parsed/displayed as a v7 UUID throughout the MCP/CLI surface
(explicitly time-ordered). Switching would require re-typing
WorkflowRunId from Uuid to String across the crate and would lose the v7
time-ordering property, which is a materially different and larger
change than the 'low - consistency' severity implies.

Added regression tests: concurrent_wait_events_same_name_both_resolve
and dependent_of_failed_step_gets_terminal_status.

cargo test -p flare-workflow (55 tests) + agentflare workflow::/
mcp_server::workflow:: tests (7 tests) pass; fmt + clippy
(-D warnings -A unsafe_code -A clippy::pedantic) clean workspace-wide.

Agentflare-Agent: claude-code
Agentflare-Branch: task/447
Agentflare-Item: 447

* fix(flare-workflow): drop unmaintained backoff crate, regen hakari workspace-hack

Replace the RUSTSEC-flagged backoff crate with a hand-rolled exponential
strategy in retry.rs (base * 1.5^n, capped at max) — the crate's own
randomization was redundant with apply_jitter anyway. Regenerate
agentflare-workspace-hack via cargo hakari generate to pick up
flare-workflow's dependency set.

Agentflare-Agent: claude-code
Agentflare-Branch: task/447
Agentflare-Item: 447

* fix(flare-workflow): resolve CodeRabbit findings — durable sleep, update race, db_path

Three real bugs surfaced by the fresh full-diff CodeRabbit review on PR #472:

- waits.rs execute_sleep recomputed wake_at from Utc::now() on every call,
  including on crash-recovery re-arm, so a durable Sleep never resumed its
  original deadline — every restart pushed the wake time out further. Now
  reuses the wake_at from an existing pending Sleep journal entry.
- sqlite_store.rs SqliteStore::update released the connection lock between
  its load and write, so concurrent updates on the same run (e.g. two
  fan-out branches completing close together) could race and silently drop
  one's mutation. Added update_lock held across the whole cycle.
- mcp_server/workflow.rs honored a client-supplied db_path in production,
  letting any MCP caller point the workflow store at an arbitrary file. The
  override is now test-only (cfg!(test)); production always uses the
  default ~/.agentflare/workflows.db path.

Added regression tests for the first two (recover_reams_pending_sleep now
asserts wake_at is preserved across the crash boundary;
concurrent_updates_on_same_run_do_not_lose_writes spawns 20 concurrent
updates and asserts none are lost). The db_path fix isn't independently
testable — cfg!(test) is true for any test binary — so it's covered by the
existing MCP tests continuing to pass with their tempdir overrides.

Remaining CodeRabbit nitpicks (eprintln vs tracing, brittle journal_tail
count assertion, README doctest formatting, missing composite index,
discarded delete_state errors in cleanup, executor.rs default is_retryable,
non-blocking cancellation test, duplicate StepId validation, WaitEvent
journal entries not scoped by step_id, EntryResult::success swallowing
serialization errors, InMemoryStore::journal NotFound vs empty-vec
inconsistency, fan_group dependency derivation edge case) are lower-severity
style/robustness items left for a follow-up pass rather than folded into
this bugfix. The journal.rs 'use RETURNING instead of a second SELECT'
suggestion was checked and is a non-issue here: all journal writes go
through the same Arc<Mutex<Connection>>, so there's no race for it to fix.

Agentflare-Agent: claude-code
Agentflare-Branch: task/447
Agentflare-Item: 447
getappz added a commit that referenced this pull request Aug 27, 2026
…t finalize (#622)

* No clippy warnings in the files I touched. The implementation is complete and verified.

## Status

Implemented per-turn checkpoint commits + finalize-time squash in `build_sdd_loop_step`/`build_finalize_step` (`src/work_item_pipeline.rs`), building on #191's `worktree_path` threading:

- **`crates/flare-git-core/src/worktree.rs`**: added `commit_uncommitted_at` (path-based variant of `commit_uncommitted`, with a `no_verify` flag), `head_sha`, and `squash_since` (`git reset --soft`). `commit_uncommitted` now delegates to `commit_uncommitted_at`. Thin wrappers added in `src/worktree.rs`.
- **`WorkItemData`**: added `checkpoint_base_sha: Option<String>`.
- **`build_sdd_loop_step`**: role dispatch now also returns `is_implementer_turn` (true only for non-review-only implementer/fix dispatches, never for judge/reviewer/analyst turns). After a successful implementer-turn `send()`, `checkpoint_implementer_turn` commits with `--no-verify` (skipping the LOC-freeze gate per open question #1) and lazily captures the pre-checkpoint HEAD sha.
- **`build_finalize_step`**: right before the existing `item_done` call, squashes every checkpoint commit back to `checkpoint_base_sha` via `squash_since`, so `item_done`'s own `commit_uncommitted` (which does run the LOC-freeze pre-commit hook) evaluates the whole run's diff as one commit. `.take()` on the sha prevents a step retry from double-squashing.
- Commit message convention: `wip(sdd-loop): task {id} checkpoint` (open question #2) — disposable, just grep/reflog-identifiable.

**One real bug caught and fixed during implementation**: my first draft fell back to the ambient process cwd when `worktree_path` was empty (mirroring `real_agent_send_hook`'s dispatch fallback). Running the test suite actually committed my own uncommitted working-tree changes into this session's real git history, since the test harness has no `worktree_path` set and ambient cwd was this repo. I reset that commit (`git reset --soft`, verified only my own 3 in-progress files were affected) and changed the checkpoint function to no-op entirely when `worktree_path` is empty — a `git commit` has no safe ambient fallback, unlike read-only agent dispatch. Added a regression test (`checkpoint_implementer_turn_is_a_noop_without_a_worktree_path`) guarding this specifically.

**Tests added**: 4 in `flare-git-core/src/worktree_tests.rs` (`commit_uncommitted_at`, `head_sha` ×2, `squash_since`), 2 in `work_item_pipeline/tests.rs` (no-op guard, and an end-to-end commit+squash test against a real claimed worktree). All pass — 207/207 (flare-git-core), 83/83 (work_item_pipeline module, 2 pre-existing unrelated ignores).

**Verification**: full builds clean, `scripts/loc-gate.sh` passes on every file I touched (had to trim doc comments twice to stay under work_item_pipeline.rs's 1500-line limit — now 1498), clippy shows no new warnings in touched files. One pre-existing repo-wide LOC-gate failure in `src/mcp_server/tests/item_tests.rs` (untouched by me, and per the gate script's own comments, not wired into CI) — not in scope.

No concerns beyond the above; nothing committed, per instructions this is left for your review.

Agentflare-Agent: claude-code_2-1-245_agent
Agentflare-Branch: task/193-sdd-loop-commit-progress-after-each-impl
Agentflare-Item: 193-sdd-loop-commit-progress-after-each-impl

* fmt

Agentflare-Agent: claude-code
Agentflare-Branch: pr-622-fmt-fix
Agentflare-Session: e77fc32e-33d0-4884-ab55-fdda48fe45fd

---------

Co-authored-by: shiva <shiva@gosysinfo.tech>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant