Repository navigation
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 - #1265
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.2...043fb46) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
github_actions
burtenshaw
added
enhancement
Cursor
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated Checks
- Lint: N/A - diff only touches
.github/workflows/validation-runtime.yml(a single line, SHA pin + version comment); nosrc//tests/Python changed, sousort/ruffchecks have nothing to evaluate here. (Note:bash .claude/hooks/lint.shcouldn't run in this sandbox becauseuvwasn't on PATH — an environment issue unrelated to this PR.) - Debug code: CLEAN -
check-debug.shonly surfaces pre-existingprint()/TODOoccurrences in docstrings and a known test file, none introduced by this diff.
Change Summary
Bumps actions/upload-artifact from 4.6.2 to 7.0.1 in validation-runtime.yml, pinned by commit SHA with the version as a comment (matches repo convention). I verified 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a is in fact the commit for tag v7.0.1 upstream, so the pin is correct and not spoofed/stale.
This also brings validation-runtime.yml in line with the other three workflows (publish-pypi.yml, publish-testpypi.yml, discovery-catalog.yml) that already reference actions/upload-artifact@043fb46d... # v7.0.1 — so this PR removes a version inconsistency rather than introducing one.
Reviewed upstream release notes for v5/v6/v7: the only behavioral changes are (1) Node.js 24 runtime (fine on GitHub-hosted ubuntu-24.04 runners used here) and (2) an opt-in archive: false direct-upload mode that this workflow doesn't use. No changes affect the name/path/if-no-files-found inputs already in use, so this should be a safe, non-breaking bump for this job.
Open RFCs Context
Scanned rfcs/ (000–005, 008, 010–012). None concern CI/CD infrastructure, artifact retention, or GitHub Actions tooling, so no open RFC intersects with this change.
Tier 1: Fixes Required
None.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This is a CI dependency bump; it doesn't touch the environment/client/server API surface, reward logic, or any of the principles in PRINCIPLES.md/INVARIANTS.md.
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
This PR looks safe to merge as-is.
Sent by Cursor Automation: Pre-review
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
|
Looks like actions/upload-artifact is up-to-date now, so this is no longer needed. |
Bumps actions/upload-artifact from 4.6.2 to 7.0.1.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only dependency pin with no application or secrets logic changes; verify the validation-runtime job still uploads artifacts after the major-version bump.
Overview
Updates the Retain evidence on success or failure step in
validation-runtime.ymlto pinactions/upload-artifactfrom v4.6.2 to v7.0.1 (new commit SHA). Artifact inputs are unchanged: same name,outputs/validation-runtime/path,if-no-files-found: warn, and 14-day retention.This brings that workflow in line with other repo workflows that already use upload-artifact v7. The jump spans major releases (Node 24 runner in v6+, ESM in v7); this step still uploads a directory as before and does not use the new direct/unzipped upload option.
Reviewed by Cursor Bugbot for commit 0ac30b4. Bugbot is set up for automated code reviews on this repo. Configure here.