chore(deps): update actions/download-artifact action to v7

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
actions/download-artifact	action	major	v6 -> v7

---

Release Notes

actions/download-artifact (actions/download-artifact)

v7

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[claude]

PR Review: Update actions/download-artifact to v7

Summary

This PR updates actions/download-artifact from v6 to v7 across three usages in the speed comparison workflow.

---

✅ Strengths

1. Consistency: All three instances of actions/download-artifact are updated together, maintaining version consistency across the workflow.

2. Low Risk: This is a dependency update in CI/CD infrastructure, not touching any core TUnit code. The change is isolated to GitHub Actions workflow configuration.

3. Automated Management: Being generated by Renovate Bot ensures systematic dependency tracking.

4. Proper Scope: The change is appropriately scoped - only updating the action version numbers without modifying any workflow logic.

---

🔍 Code Quality Assessment

Changes Made:

• Line 66: actions/download-artifact@v6 → actions/download-artifact@v7
• Line 141: actions/download-artifact@v6 → actions/download-artifact@v7
• Line 148: actions/download-artifact@v6 → actions/download-artifact@v7

All three usages:

1. Line 66 (run-time-benchmarks job): Downloads build artifacts to restore compiled test builds
2. Line 141 (process-and-upload-benchmarks job): Downloads runtime benchmark results with pattern matching
3. Line 148 (process-and-upload-benchmarks job): Downloads build time benchmark results with pattern matching

---

⚠️ Considerations & Recommendations

1. Test the Workflow

While this is likely a straightforward update, I recommend:

• Monitoring the first workflow run after merge to ensure artifact downloads work correctly
• Verifying that pattern matching behavior (lines 141, 148) remains compatible
• Confirming that merge-multiple: false parameter is still supported in v7

2. Check for Breaking Changes

Before merging, verify:

• Whether v7 has any breaking changes from v6 (check the release notes)
• If there are any deprecated parameters or changed defaults
• Whether the pattern parameter behavior is unchanged

3. Version Pinning Strategy

Observation: This workflow uses major version tags (v7, v6) rather than commit SHAs.

Consideration: For security-critical workflows, consider:

• Using full commit SHAs: actions/download-artifact@abc123...
• Or at minimum patch versions: actions/[email protected]

However, major version tags are acceptable for most use cases and provide automatic patch/minor updates.

4. Inconsistency with Other Actions

Observation: This workflow uses different versioning strategies:

• actions/checkout@v6 (lines 14, 56, 100, 135)
• actions/setup-dotnet@v5 (lines 19, 61, 105)
• actions/upload-artifact@v5 (multiple locations)
• actions/download-artifact@v7 (after this PR)

Recommendation: Consider updating all GitHub Actions to their latest versions for consistency, but this can be done separately.

---

🐛 Potential Issues

None identified - this is a straightforward dependency update.

Risk Level: ⚠️ Low

The change is minimal and isolated. The primary risk is if v7 introduces breaking changes not documented in the PR description.

---

🧪 Testing Recommendations

1. Workflow Validation: Allow the workflow to run on a scheduled trigger or manually trigger it after merge
2. Artifact Verification: Ensure all three download steps complete successfully:
   • Build artifacts download (line 66)
   • Runtime benchmark artifacts with pattern matching (line 141)
   • Build time benchmark artifacts with pattern matching (line 148)
3. End-to-End Check: Verify the final benchmark PR is created successfully

---

📝 Compliance with TUnit Standards

Per CLAUDE.md:

• ✅ No source code changes (CI/CD only)
• ✅ No dual-mode implementation needed
• ✅ No snapshot tests affected
• ✅ No public API changes
• ✅ No performance impact on TUnit itself

This PR does not require the standard TUnit development checklist as it's purely infrastructure.

---

✅ Recommendation

APPROVE with the following suggestions:

1. ✅ Safe to merge as-is if Renovate Bot has verified compatibility
2. 📋 Monitor the first workflow run post-merge
3. 🔄 Consider checking the v7 release notes for any behavioral changes
4. 📌 Future consideration: Evaluate pinning to specific versions for better security

---

🤖 Auto-merge Status

The PR description indicates automerge is enabled. Given this is a low-risk dependency update managed by Renovate Bot, auto-merge is appropriate for this change.

Overall Assessment: ✅ LGTM (Looks Good To Me)

[Copilot]

Pull request overview

This PR updates the actions/download-artifact GitHub Action from v6 to v7 across all usages in the speed comparison workflow, as part of automated dependency maintenance by Renovate Bot.

Key Changes:

• Updates three instances of actions/download-artifact from v6 to v7 in the speed comparison workflow

[claude]

PR Review: Update actions/download-artifact to v7

Summary

This is a straightforward dependency update PR from Renovate Bot that upgrades actions/download-artifact from v6 to v7 across the speed-comparison workflow.

---

✅ Code Quality & Best Practices

APPROVED - The changes are clean and consistent:

• All 3 instances of actions/download-artifact@v6 have been updated to v7
• No syntax or parameter changes needed (API compatible)
• Follows the existing workflow patterns

---

✅ Correctness

APPROVED - The upgrade appears safe:

• The name and path parameters remain unchanged (these are the core parameters)
• The pattern and merge-multiple parameters used in lines 144 and 151 are still supported in v7
• Usage patterns match the documented v7 API

---

✅ Performance Considerations

NEUTRAL - No performance concerns:

• This is an infrastructure dependency update
• GitHub Actions artifact handling is managed by GitHub's infrastructure
• No impact on TUnit's runtime or build performance

---

✅ Security Concerns

APPROVED - Security is improved:

• Using the latest major version ensures you get security patches
• GitHub Actions are generally secure when pinned to major versions
• Consider pinning to commit SHA for maximum security (e.g., actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 for v7.0.0), but major version pinning is acceptable for this use case

---

✅ Test Coverage

N/A - This is a CI/CD workflow change:

• No code changes to TUnit itself
• The workflow will be tested when it runs
• Recommend monitoring the next scheduled run (daily cron: 0 0 * * *) to ensure artifacts download correctly

---

📋 Recommendations

1. Monitor First Run: After merging, watch the next speed-comparison workflow run to verify:

   • Artifacts download successfully at line 66
   • Benchmark processing works correctly at lines 141 and 148
   • No unexpected errors in artifact retrieval

2. Optional Security Hardening: Consider pinning to commit SHA instead of major versions:

   # Instead of:
   uses: actions/download-artifact@v7
   
   # Consider:
   uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v7.0.0

3. Consistency Check: While not related to this PR, I notice actions/upload-artifact is still on v5 (lines 37, 84, 119, 164, etc.). You may want to track upgrading that to v6+ in a future update.

---

🎯 Final Verdict

✅ APPROVED - Ready to Merge

This is a clean, automated dependency update with no breaking changes. The upgrade path from v6 to v7 is smooth, and all parameters are compatible. Since automerge is enabled and this follows standard dependency update practices, this PR is safe to merge.

Risk Level: ⬜ Low
Recommended Action: Merge and monitor first workflow run

[claude]

Code Review - PR #4070

Summary

This PR updates actions/download-artifact from v6 to v7 across the speed-comparison workflow. This is a dependency update generated by Renovate Bot.

Review Findings

✅ Positive Aspects

1. Minimal Change Scope: The update is focused and only touches the GitHub Actions workflow file, reducing risk.

2. Consistent Application: All three usages of actions/download-artifact in the workflow are updated consistently (lines 66, 141, and 149).

3. Automated Update: Using Renovate Bot for dependency updates is a good practice for keeping dependencies current.

4. No Code Impact: This is a CI/CD change only and doesn't affect TUnit's core functionality, source generator, or reflection engine.

⚠️ Considerations

1. Breaking Changes Unknown: Without access to the v7 release notes, I cannot verify if there are breaking changes. Key things to verify:

   • Does v7 maintain backward compatibility with v6 syntax?
   • Are there any new required parameters?
   • Are the pattern and merge-multiple options still supported in v7?

2. Testing Recommendation: Before merging, ensure:

   • The Build_Tests job completes successfully and artifacts are created
   • The Speed_Comparison job can download the artifacts properly
   • The Comment job receives all expected benchmark results

3. Workflow Verification: Specifically test these scenarios:

   • Downloading with name parameter (line 66)
   • Downloading with pattern and merge-multiple: false (lines 141-145)
   • Downloading with pattern only (lines 149-152)

📋 Code Quality

• ✅ Follows consistent formatting
• ✅ No syntax errors
• ✅ Aligns with TUnit's CI/CD practices

🎯 TUnit-Specific Compliance

Per CLAUDE.md guidelines:

• ✅ No dual-mode impact: This is CI-only, doesn't affect source-gen or reflection modes
• ✅ No snapshot updates needed: No code changes to TUnit itself
• ✅ No public API changes: No impact on TUnit.Core, TUnit.Engine, or TUnit.Assertions
• ✅ No performance concerns: CI change only
• ✅ No security concerns: Using official GitHub Actions from trusted source

Recommendation

LGTM with verification ✓

This is a straightforward dependency update that appears safe. However, I recommend:

1. Monitor the first CI run after merge to ensure all artifact download operations work correctly
2. Verify benchmark comparison comments are posted successfully to PRs after this change
3. Rollback plan: If issues occur, revert to v6 is trivial (just change the version numbers back)

The automerge is enabled, which is appropriate for this type of low-risk dependency update, but keep an eye on the CI results.

---

Review completed: No blocking issues found. The change follows best practices for dependency updates.

[claude]

PR Review: Update actions/download-artifact to v7

✅ Overall Assessment

This PR looks good to merge. It's a straightforward dependency update from Renovate Bot upgrading actions/download-artifact from v6 to v7.

---

📋 Code Quality & Best Practices

✅ Positive Points:

• Clean, focused change updating all 3 instances of download-artifact in the workflow
• Consistent upgrade across the entire file
• No breaking changes in usage patterns - all parameters remain valid

📝 Observations:

• All three usages maintain their existing parameters:
  • Line 66: Downloads test-builds-ubuntu with specific path
  • Line 141: Uses pattern and merge-multiple: false for runtime benchmarks
  • Line 148: Uses pattern for build time benchmarks
• The workflow continues to use upload-artifact@v5 (11 instances) - this is fine as v5/v7 are compatible

---

🐛 Potential Issues

No issues identified. The upgrade path from v6 to v7 is seamless:

• All existing parameters (name, path, pattern, merge-multiple) are supported in v7
• No API breaking changes that affect this workflow
• The pattern-based downloads with merge-multiple: false work identically

---

⚡ Performance Considerations

Neutral/Positive:

• v7 may include internal optimizations from the GitHub Actions team
• No performance regressions expected
• Artifact download patterns remain unchanged

---

🔒 Security Concerns

✅ No security concerns.

• Official GitHub Actions dependency from a trusted source
• Major version updates are tested by the Actions team
• Renovate Bot has been configured with automerge, which is appropriate for official GitHub Actions

---

🧪 Test Coverage

Considerations:

• This is an infrastructure change that won't break existing functionality
• The workflow will validate itself on next scheduled run (daily cron) or manual trigger
• Recommend monitoring the next workflow run to ensure artifacts download correctly

---

🎯 Recommendations

1. ✅ Merge this PR - It's a safe, routine dependency update
2. 📊 Monitor next run - Watch the next scheduled speed-comparison workflow execution to confirm artifacts download successfully
3. Optional: Consider updating upload-artifact to v6 in a future PR for consistency (though v5 remains fully compatible)

---

📚 Alignment with TUnit Standards

Checking against CLAUDE.md:

• ✅ This is an infrastructure change, not code - no dual-mode implementation needed
• ✅ No source generator changes - no snapshot updates required
• ✅ No public API changes
• ✅ No performance-critical code paths affected
• ✅ No AOT/trimming implications

---

Final Verdict: LGTM! 🚀

The automerge configuration is appropriate for this type of routine dependency update from official GitHub Actions.