Skip to content

chore(deps): bump actions/upload-artifact from 4 to 7 #2326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump actions/upload-artifact from 4 to 7 #2326

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/g014-catalog-contract-baseline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ jobs:
--output "$RUNNER_TEMP/g024-dual-clean-replay.json"

- name: Upload dual clean replay evidence
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with:
name: g024-dual-clean-replay-${{ github.sha }}
path: |
Expand Down Expand Up @@ -118,7 +118,7 @@ jobs:
--validate-artifact artifacts/hosted-migration-ledger.json

- name: Upload hosted migration-ledger artifact
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with:
name: hosted-migration-ledger-${{ github.sha }}
path: artifacts/hosted-migration-ledger.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/g014-historical-migration-ledger.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
run: python backend/supabase/scripts/read_hosted_migration_ledger.py --validate-artifact artifacts/hosted-migration-ledger.json

- name: Upload migration-ledger artifact
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
with:
name: hosted-migration-ledger
path: artifacts/hosted-migration-ledger.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/g034-hosted-migration-preflight.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ jobs:
SUPABASE_DB_URL: ${{ secrets.SUPABASE_DB_URL }}
run: python backend/supabase/scripts/preflight_g034_hosted_migration_closure.py --artifact g034-hosted-preflight.json
- name: Upload sanitized bounded preflight artifact
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
if: always()
with:
name: g034-hosted-preflight-${{ github.sha }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/g037-hosted-closure.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
python backend/supabase/scripts/g037_hosted_closure_executor.py validate > "$RUNNER_TEMP/g037-receipts/validate-${GITHUB_SHA}.json"
- name: Upload sanitized source-validation receipt
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the G037 workflow contract for the new pin

When backend.supabase.tests.test_g037_hosted_closure_workflow is run, it still asserts that the workflow's uses set contains actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08; after this line points at 043fb46..., that source-contract test fails before validating the hosted-closure safety checks. Please update the backend contract test or centralize the approved upload-artifact hash as part of this bump.

Useful? React with 👍 / 👎.

with:
name: g037-hosted-closure-validate-${{ github.sha }}
path: ${{ runner.temp }}/g037-receipts/validate-${{ github.sha }}.json
Expand Down Expand Up @@ -97,7 +97,7 @@ jobs:
timeout --signal=TERM --kill-after=5s 120s python backend/supabase/scripts/g037_hosted_closure_executor.py "$REQUESTED_MODE" --db-env SUPABASE_DB_URL > "$RUNNER_TEMP/g037-receipts/${REQUESTED_MODE}-${GITHUB_SHA}.json"
- name: Upload sanitized hosted receipt
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
with:
name: g037-hosted-closure-${{ inputs.mode }}-${{ github.sha }}
path: ${{ runner.temp }}/g037-receipts/${{ inputs.mode }}-${{ github.sha }}.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/g038-account-deletion-successor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
with:
subject-path: ${{ runner.temp }}/g038-source-receipt/receipt.json
- name: Upload authenticated source receipt and exact attestation bundle
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the G038 source contract pin

The G038 workflow now uses the v7.0.1 SHA, but backend/supabase/tests/test_g038_workflow.py still defines UPLOAD as actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 and then compares both the full actions list and this upload step to that constant in assert_safe_workflow (lines 82-99). In any environment with PyYAML installed, the G038 source-contract test fails before it can validate the account-deletion source-only boundary, so this bump needs the same test/approved-hash update as the workflow.

Useful? React with 👍 / 👎.

with:
name: g038-account-deletion-successor-source-receipt
path: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/g040-prefix-recovery.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
PY
- name: Upload bounded sanitized source receipt
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the G040 workflow contract for the new pin

When backend.supabase.tests.test_g040_prefix_recovery_workflow is run, its UPLOAD constant still names actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08, and the test both checks the allowed uses set and looks up the upload step by that exact value. With this workflow now using 043fb46..., the contract test fails instead of protecting the G040 source-validation boundary, so the test needs the same approved-hash update.

Useful? React with 👍 / 👎.

with:
name: g040-prefix-recovery-source-receipt
path: ${{ runner.temp }}/g040-receipts/receipt.json
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/nightly-local-regression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,7 +254,7 @@ jobs:

- name: Upload sanitized local nightly artifacts
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v4
with:
name: nightly-local-${{ github.run_id }}
path: nightly-artifacts/
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/nightly-regression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ jobs:
PY
- name: Upload redacted unit diagnostics
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: nightly-unit-diagnostics
path: apps/web/nightly-artifacts/nightly-unit-redacted.log
Expand Down Expand Up @@ -270,7 +270,7 @@ jobs:
PY
- name: Upload redacted browser diagnostics
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: nightly-playwright-diagnostics
path: apps/web/nightly-artifacts/
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/security-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ jobs:
)

- name: Upload bounded SBOM evidence
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
with:
name: security-sbom-${{ github.event.pull_request.head.sha || github.sha }}
path: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ts7-release-evidence.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ jobs:
- id: upload
name: Upload strictly validated final bundle only
if: steps.verify-bundle-digest.outcome == 'success'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ts7-release-evidence-final-bundle
path: |
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/web-admin-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ jobs:
)
- name: Upload clean-install lock evidence
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
with:
name: dependency-modernization-lock-evidence-${{ github.run_id }}
path: ${{ runner.temp }}/dependency-modernization-proof/**/dependency-modernization-lock-hashes-*.txt
Expand Down Expand Up @@ -203,7 +203,7 @@ jobs:
REPORT="$RUNNER_TEMP/ts7-release/$tree/ubuntu-npm/report.json" TREE="$tree" node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="ubuntu-npm"||r.candidate?.platform!=="linux-x64"||r.candidate?.installer!=="npm"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
- name: Upload npm benchmark evidence
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
with:
name: ts7-benchmark-ubuntu-npm-${{ github.run_id }}
path: ${{ runner.temp }}/ts7-release
Expand Down Expand Up @@ -254,7 +254,7 @@ jobs:
REPORT="$RUNNER_TEMP/ts7-release/$tree/ubuntu-bun/report.json" TREE="$tree" node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="ubuntu-bun"||r.candidate?.platform!=="linux-x64"||r.candidate?.installer!=="bun"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
- name: Upload Bun benchmark evidence
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
with:
name: ts7-benchmark-ubuntu-bun-${{ github.run_id }}
path: ${{ runner.temp }}/ts7-release
Expand Down Expand Up @@ -315,7 +315,7 @@ jobs:
node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="windows-npm"||r.candidate?.platform!=="win32-x64"||r.candidate?.installer!=="npm"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
- name: Upload npm benchmark evidence
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
with:
name: ts7-benchmark-windows-npm-${{ github.run_id }}
path: ${{ runner.temp }}/ts7-release
Expand Down Expand Up @@ -369,7 +369,7 @@ jobs:
node -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.env.REPORT,"utf8"));if(r.releaseId!==process.env.TREE||r.candidate?.tree!==process.env.TREE||r.candidate?.profile!=="windows-bun"||r.candidate?.platform!=="win32-x64"||r.candidate?.installer!=="bun"||r.acceptance?.passed!==true)throw new Error("invalid benchmark report");'
- name: Upload Bun benchmark evidence
if: always()
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
with:
name: ts7-benchmark-windows-bun-${{ github.run_id }}
path: ${{ runner.temp }}/ts7-release
Expand Down
Loading