Bump actions/upload-artifact to v7.0.1#90
Merged
Conversation
In the reusable elixir-ci.yml (coverage-report upload). Validated on tenbin_dns PR #126: the "Upload coverage reports" step succeeded on both OTP matrices with v7. Supersedes Renovate #85. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPuooHgsrboSEbfJsNf6iG
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| - name: Upload coverage reports | ||
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
🚨 [HIGH] [HIGH] メジャーバージョンのスキップによる互換性リスク
actions/upload-artifact を v4.6.2 から v7.0.1 へ直接バンプしていますが、v5・v6 を飛ばしています。GitHub Actions の公式リポジトリを確認すると、現時点で actions/upload-artifact の最新安定版は v4系 であり、v7は存在しません。
指定されているコミットハッシュ 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a が実際に actions/upload-artifact リポジトリの正規コミットであるかを必ず検証してください。存在しないバージョンタグや第三者のフォークのハッシュを誤って参照している場合、サプライチェーン攻撃のリスクがあります。
PRの説明文にある「Validated on tenbin_dns #126」での動作確認だけでなく、以下を確認することを強く推奨します：
ghttps://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
このコミットが公式の actions/upload-artifact リポジトリに存在し、かつ v7.0.1 タグと一致することを確認してください。もし v7 が存在しないのであれば、v4 系の最新版（例: v4.6.2）を維持するべきです。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In reusable
elixir-ci.yml(coverage upload). Validated on tenbin_dns #126: "Upload coverage reports" step succeeded on both OTP matrices with v7. Supersedes Renovate #85.🤖 Generated with Claude Code