Skip to content

Bump actions/upload-artifact from 4 to 7 #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump actions/upload-artifact from 4 to 7 #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,7 @@ jobs:
godot --headless --path . --export-release "Android" build/UploadSimulator.apk

- name: Upload APK artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jun 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Получение хеша коммита для actions/upload-artifact@v7

gh api repos/actions/upload-artifact/git/refs/tags/v7 --jq '.object.sha' 2>/dev/null || \
gh api repos/actions/upload-artifact/releases/tags/v7 --jq '.target_commitish' 2>/dev/null || \
echo "Не удалось получить хеш для v7. Проверьте вручную на https://github.com/actions/upload-artifact/releases"

Repository: rkfsociety/UploadSimulator

Length of output: 111

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# show relevant section around line ~165
nl -ba .github/workflows/ci.yml | sed -n '140,190p'

Repository: rkfsociety/UploadSimulator

Length of output: 113

🌐 Web query:

actions/upload-artifact v7 default archive true archive=false breaking changes

💡 Result:

In actions/upload-artifact v7, a new input parameter named archive has been introduced, allowing users to opt into direct file uploads without zip compression [1][2]. Key details regarding this feature and v7 changes: 1. New 'archive' Input: The new archive parameter defaults to 'true' to maintain backward compatibility [1][2]. When set to 'false', the action will attempt to upload a single file directly without archiving [1][3]. 2. Limitations of 'archive: false': - It only supports uploading a single file [1][4]. The action will fail if the provided path resolves to multiple files [1][2]. - The 'name' parameter is ignored when 'archive: false' is used [1][4]. Instead, the filename of the uploaded file becomes the name of the artifact [1][4]. 3. Breaking Changes: While v7 is a major version, there are no traditional "breaking" changes for existing workflows, as the new archive parameter is optional and defaults to 'true' [1][2]. The primary technical change is the upgrade of the action to ESM (ECMAScript Modules) to support new @actions/* package versions [1][5]. Some users have noted that the release notes did not explicitly document the ESM upgrade as a breaking change [6]. 4. Ecosystem Requirements: If you choose to use 'archive: false' to upload non-zipped artifacts, you must also use actions/download-artifact v8 (or newer) to download them [3]. Top results: [1], [2], [3], [4]

Citations:

🌐 Web query:

actions/upload-artifact v7 node version requirement v6 v7 runtime

💡 Result:

Starting with version 6, the actions/upload-artifact action runs on Node.js 24 [1][2]. This requirement persists in version 7 [1][3]. Key details regarding the Node.js 24 runtime requirement include: - Default Runtime: Beginning with v6.0.0, the action transitioned to using Node.js 24 (runs.using: node24) by default [1][2]. While v5 included preliminary support, it continued to default to Node.js 20 [2][4]. - Runner Compatibility: Upgrading to v6 or v7 requires a minimum Actions Runner version of 2.327.1 [2][4]. Users of self-hosted runners must ensure their runners are updated to at least this version before upgrading the action [1][2]. - Version 7 Updates: While v7 maintains the Node.js 24 runtime requirement, its primary changes over v6 include the addition of direct file uploads (allowing unzipped uploads via the new archive: false parameter) and an upgrade to ESM (ECMAScript Modules) to support updated @actions packages [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# show the exact upload-artifact usage area without relying on `nl`
sed -n '150,180p' .github/workflows/ci.yml

# find related artifact download steps in the workflow
rg -n "download-artifact@|upload-artifact@" .github/workflows/ci.yml

Repository: rkfsociety/UploadSimulator

Length of output: 1344

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "download-artifact@|upload-artifact@" .github/workflows/ci.yml

# Show nearby context for any matches
rg -n "download-artifact@|upload-artifact@" .github/workflows/ci.yml | cut -d: -f1 | sort -nu | while read -r line; do
  echo "---- around line $line ----"
  sed -n "$((line-10)),$((line+10))p" .github/workflows/ci.yml
done

Repository: rkfsociety/UploadSimulator

Length of output: 964

Закрепите actions/upload-artifact по commit SHA (supply-chain безопасность).
Сейчас используется тег actions/upload-artifact@v7 (стр. ~165); теги могут перемещаться. Замените на actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 165-165: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 165, Replace the floating tag usage of the
GitHub Action in the workflow step that currently says "uses:
actions/upload-artifact@v7" with the exact commit SHA to pin the version for
supply-chain safety; update that line to "uses:
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" so the CI step
uses the fixed commit instead of the mutable tag.

with:
name: UploadSimulator-apk
path: build/UploadSimulator.apk
Expand Down
Loading