From 74c14b55a445e16a3fa5fb346ac14744160dbb79 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 20:12:47 +0000 Subject: [PATCH 1/2] chore(deps): bump actions/download-artifact Bumps the github-actions group with 1 update: [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e56b53d..2972796 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -100,7 +100,7 @@ jobs: with: ref: ${{ needs.package.outputs.revision }} persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: source-release-${{ github.sha }} path: build/release/ @@ -138,7 +138,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.18.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: source-release-${{ github.sha }} path: build/release/ From fdd94b4c91fe8e9aafd18db257f0aa81a3e2a2f6 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Sun, 18 Oct 2026 03:09:13 -0500 Subject: [PATCH 2/2] chore(ci): pin the reviewed release workflow after the download-artifact 8.0.2 bump The bump changes only the two actions/download-artifact pins in release.yml (9000827c is upstream tag v8.0.2), so the id-token: write allowance moves to the new workflow hash. Owner-approved, as in #52. Co-Authored-By: Claude Opus 5.5 --- tools/check-crate-release-policy.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/check-crate-release-policy.py b/tools/check-crate-release-policy.py index 10ed794..1d63db9 100755 --- a/tools/check-crate-release-policy.py +++ b/tools/check-crate-release-policy.py @@ -17,7 +17,7 @@ PUBLISH_WORKFLOW = WORKFLOWS / "publish-crate.yml" BOOTSTRAP_CHECK = ROOT / "tools" / "check-crate-publication.py" SOURCE_WORKFLOW = WORKFLOWS / "release.yml" -EXPECTED_SOURCE_WORKFLOW_SHA256 = "4ab75eea4c9d25005384f222f9f24865ffa1ddee48d40a32b8e99efcad6822b9" +EXPECTED_SOURCE_WORKFLOW_SHA256 = "13b592fd367f87ebc8c4926a514f110faadf4804206b8a2fd1e19c57b07d17c9" EXPECTED_PUBLICATION_WORKFLOW_SHA256 = "b21e9b715650b5f0b3f5b77eb563a4b78a0e5dbe9f07c09953fc64c6fe3f3c41" EXPECTED_WORKFLOWS = { "dependency-review.yml", "pr-title.yml", "release.yml", "validate.yml",