chore(deps): bump actions/upload-artifact from 4 to 7 - #126
chore(deps): bump actions/upload-artifact from 4 to 7#126dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
ghost
left a comment
ghost
left a comment
There was a problem hiding this comment.
✅ Approved — CI dependency bump, no protocol impact
Scope: Single-line change in .github/workflows/acme-test.yml:65 — actions/upload-artifact@v4 → @v7. Only fires on if: failure() to upload test logs. No code, no protocol logic, no runtime impact.
Checked:
- Full diff: one line, correct syntax,
name/path/if-no-files-foundparams are all compatible with v7. release.ymlalready uses@v7— this bringsacme-test.ymlin line.- No cross-repo impact (CI-only change).
- v7 release notes confirm backward-compatible for this usage pattern (zip-based multi-file upload with
name).
Nit (non-blocking): test/app/.github/workflows/build-eif.yml:41 still pins @v4. Consider bumping that too for consistency, though it lives in the test-app subtree so dependabot may not pick it up automatically.
LGTM — safe to merge.
arkana-ai-bot
left a comment
arkana-ai-bot
left a comment
There was a problem hiding this comment.
Scope: one-line bump of actions/upload-artifact v4 → v7 in .github/workflows/acme-test.yml:65. Not protocol-critical.
Assessment:
- Only consumer touched is the failure-path "Upload logs on failure" step (
name,path,if-no-files-found: ignore). None of v5/v6/v7's breaking changes affect this usage — v5/v6 are the Node 24 runtime bump (fine onubuntu-latest), v7 adds an optionalarchiveparam that defaults totrue(preserves prior behavior). - Consistency:
release.yml:177is already on@v7, so this aligns the repo on a single major. - Cross-repo: pure CI action version pin, no Go/proto/SDK surface touched. No downstream consumer impact.
- CI: acme-test, enclave-test, lint, and unit-test are all green at head
322f1b7. - Only invoked on
if: failure()— worst case a regression here would prevent debug-log upload, not affect release artifacts or production paths.
No blocking findings. LGTM as a Dependabot maintenance bump.
|
This dependency bump PR has been open 9+ days without a review. @coval3nte @g-laz77 is anyone looking at these? |
1 participant
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)