Repository navigation
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.2 - #1013
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...cf430e0) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM. This is a pinned-SHA version bump for actions/upload-artifact, and this workflow's own run on the PR exercises all three upload steps.
What was reviewed:
- All three
upload-artifactpins move to the same SHA. They still use the full-SHA plus# vX.Y.Zcomment convention, and none of the steps sets the newarchiveinput, so zipped uploads are unchanged. - The
e2e-distartifact is uploaded with v7 and downloaded withdownload-artifactv4.3.0. Both use the same v4+ artifact backend, and the E2E shards on this PR run that exact path. - v6 and later need Node 24 and runner 2.327.1 or newer. The
ubuntu-latestand Depot-managed runners should meet that, but I couldn't confirm it from here.
Extended reasoning...
Only .github/workflows/verify.yml changes: three actions/upload-artifact steps move from the v4.6.2 SHA to the v7.0.2 SHA, and nothing else in the workflow changes. No security-sensitive application code is involved, and job permissions, secrets and triggers are untouched. I couldn't check the pinned SHA against the upstream v7.0.2 tag because network access was denied here. I approved because it's a mechanical Dependabot bump that follows the repo's pinning convention, there are no CODEOWNERS or open reviewer objections, and the PR's own CI run exercises every upload step plus the v7-upload to v4-download handoff.
Bumps actions/upload-artifact from 4.6.2 to 7.0.2.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
cf430e0Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2c2acdedchore: prepare v7.0.2 release4687c1bMerge pull request #821 from actions/tunc-d-upload-artifact-package-bump8cbe1beBump@actions/artifactto 6.3.1043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)