chore(ci): bump actions/upload-artifact from 4.6.2 to 7.0.1 - #212
chore(ci): bump actions/upload-artifact from 4.6.2 to 7.0.1#212dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4.6.2...v7.0.1) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
✅ PR reviewable size is within recommended limits |
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Upload reports | ||
| if: always() | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Scorecard is correct: GitHub-owned actions in this workflow are not pinned by hash. Pinning them requires editing .github/workflows/**, which this remediator classifies as CI_PIPELINE and will not change.
Tracking: remains on Dependabot PR #212 until a dedicated workflow-pin change lands
|
|
||
| - name: Upload Scorecard Results as Artifact | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Scorecard is correct: GitHub-owned actions in this workflow are not pinned by hash. Pinning them requires editing .github/workflows/**, which this remediator classifies as CI_PIPELINE and will not change.
Tracking: remains on Dependabot PR #212 until a dedicated workflow-pin change lands
| - name: Upload License Report | ||
| if: always() | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Scorecard is correct: GitHub-owned actions in this workflow are not pinned by hash. Pinning them requires editing .github/workflows/**, which this remediator classifies as CI_PIPELINE and will not change.
Tracking: remains on Dependabot PR #212 until a dedicated workflow-pin change lands
PR Remediation — Cycle 1 SummaryCommit: none (no CODEBASE edit) | Findings processed: 3 | CI gates: not run (workflow-only PR) Acknowledged (3)
Local verify: Skipped — no source edit | Threads: replies posted; resolve follows |
|
Closing Dependabot PR as part of Quantum-L9 org-wide cleanup. Human/agent PRs remain open. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Replaced by the stacked PRs (this sibling is already closed):
Merge those bottom-up: 217 → 218 → 219. Do not squash 217 or 218 while a child is open. |
* chore(ci): collapse Dependabot pin refresh into one stack base Replace the overlapping #212/#213/#215/#216 siblings with a single bottom-of-stack commit: l9-ci-core pins to 0d28395, upload-artifact v7.0.1, and SPDX AND expressions on the license allow-list fallback so the observability layer can pass Dependency Review. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(deps): bump observability group on the pin-refresh base structlog 26.1.0 and prometheus-client 0.26.0 from #211. Lands on chore/stack-ci-pins so the SPDX AND allow-list is already present. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(ci): bump attest-build-provenance to v4.2.2 Independent docker-build.yml change from #214, stacked on the observability layer so the three PRs merge oldest-first without file fights. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): use compatible sdk-revision and keep SPDX AND licenses Baseline ratchet at l9-ci-core@0d28395 only lists b1a49141. Repo ALLOWED_LICENSES would drop Dual-license compounds from a fallback. Widen Docker/pip structlog to match Poetry 26.1.0. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): allow Dual-license observability via purl, hash-pin artifacts SPDX AND strings in allow-licenses did not match package Dual licenses and broke MIT matching for upload-artifact. Allow structlog and prometheus-client by purl; pin upload-artifact to v7.0.1 by hash. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
2 participants
Bumps actions/upload-artifact from 4.6.2 to 7.0.1.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)