chore(ci): Bump actions/download-artifact from 4 to 8

[dependabot]

Bumps actions/download-artifact from 4 to 8.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in actions/download-artifact#460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in actions/download-artifact#440
• Download Artifact Node24 support by @​salmanmkc in actions/download-artifact#415
• fix: update @​actions/artifact to fix Node.js 24 punycode deprecation by @​salmanmkc in actions/download-artifact#451
• prepare release v7.0.0 for Node.js 24 support by @​salmanmkc in actions/download-artifact#452

New Contributors

• @​patrikpolyak made their first contribution in actions/download-artifact#440
• @​salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• 3e5f45b Add regression tests for CJK characters (#471)
• e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
• 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
• f258da9 Add change docs
• ccc058e Fix linting issues
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

∵ causari · AI code survival

279 commits analyzed (git metadata only, retroactive, no setup).

AI-tagged (metadata matched): 82.0% line-weighted (5142 of 6267 lines still at HEAD, 14 commits) · 82.0% capped · median 92.5%

Of the lines introduced by metadata-matched commits, this percentage is the share git blame -w -M -C still attributes to those commits. It is not the share of the repository and it is not a quality score. Metadata matched does not prove who wrote each line. UNKNOWN and untagged are commits with no such signal; they are not a finding that a human wrote them.

Age-matched gap: +3.4 percentage points (AI-tagged 84.6% minus untagged 81.2% in the matched age windows). Positive means the metadata-matched lines have the higher line-weighted survival in those windows, over 1 matched age window holding 75% of the AI-tagged lines. Lines outside those windows are not in this gap.

Same repository, untagged lines: 192669 of 241807 still at HEAD (79.7% line-weighted, 265 commits).

Line age	AI-tagged	Untagged
0-30 d	84.6% (13 commits)	81.2% (184 commits)
30-90 d	—	63.0% (41 commits)
90-180 d	74.3% (1 commit)	63.9% (40 commits)

Agent	Commits	Introduced	Survived	Line-weighted	Capped	Median
cursor	14	6267	5142	82.0%	82.0%	92.5%

_{PROBABLE = heuristic. Counts lines from AI-tagged commits still attributed to them by git blame -w -M -C; inline completions leave no git trace and are not measured. Capped: each commit weighs at most min(p95 of per-commit introduced lines, 10000 lines); median: median of per-commit rates. Untagged = commits with no AI signal (human, inline-completed and untagged-agent code alike); age = commit date to HEAD date. absent means no introduced lines are included in the measurement (JSON null), not a measured zero and not a claim that the commits introduced nothing. An unavailable age-matched gap is not a gap of zero. Method v4: causari.dev/method. --json stores the commit, method, blame flags and counts. It does not store refs/notes/ai. The JSON field is still verified: metadata matched, not authorship proved.}

Read the age-matched gap as the comparison. An agent line marked below floor is not comparable. Meeting the floor is not a reliability guarantee.

Export: re audit <target> --json (the counts and commit bb56272aa8f6bedb9efa4aa0f166f344258f0b5b), --summary for this Markdown, --seal to sign those JSON bytes for that commit and method v4. --badge and --card write SVGs. re report is the local ledger, not this audit.

The export stores the counts, commit bb56272aa8f6bedb9efa4aa0f166f344258f0b5b, method v4, blame -w -M -C, and the coverage flags. It does not store refs/notes/ai. That ref is not part of the commit; adding or removing it can change the counts while the stored SHA stays the same. A repository that has moved has a different commit, and this export does not reproduce it.

Sealed: cs_2026_X465TCR7UWHRSNY5MX6EXL3EWA (crovia.seal.v1) over this audit of bb56272aa8f6, written to causari-audit.seal.json. Verify offline with re seal verify causari-audit.seal.json or at https://causari.dev/verify — the seal proves these exact numbers were signed for this commit, not that they are true.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	causari	e8b841c	Commit Preview URL Branch Preview URL	Oct 14 2026, 06:36 PM

[dependabot]

Dependabot can't parse your survival-report-recover.yml. Because of this, Dependabot cannot update this pull request.