[dependabot]

Bumps the github-actions group with 1 update: actions/download-artifact.

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• .github/workflows/release.yml

[zoeyrose]

Back to draft until the merge-readiness gate passes: Protocol validation fails and the branch is behind main

[zoeyrose]

Kept as a draft. Protocol validation fails in tools/check-crate-release-policy.py with disabled registry capability in release.yml: id-token: write. Main is green at a834a16, so the failure comes from this bump.

Cause: release.yml may contain id-token: write only while its SHA-256 equals EXPECTED_SOURCE_WORKFLOW_SHA256. This bump edits release.yml, so the exemption stops applying.

Fix (needs owner sign-off, because it re-anchors a security fence): update the anchor in the same change, as #52 did, and rebase onto main in the same push:

EXPECTED_SOURCE_WORKFLOW_SHA256 = "13b592fd367f87ebc8c4926a514f110faadf4804206b8a2fd1e19c57b07d17c9"

That is the SHA-256 of this branch's release.yml; main has not changed release.yml since the PR base. The new pin 9000827ccba6bdab643e8b6fd33ac0654aef8333 is the commit tagged v8.0.2 in actions/download-artifact.

[github-actions]

🎉 This PR is included in version 2.21.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀