Bump actions/upload-artifact from 4 to 7 - #404
Conversation
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
upload-artifact and download-artifact are a matched pair: the release job downloads exactly what the build job uploaded. This PR moved upload 4->7 and left download at v4, which the workflow's dry run cannot catch because the release job only runs on a tag push. Same-generation v4+ artifacts are mutually compatible, so the split was unlikely to break — but "unlikely" is a poor standard for a path that is only exercised during a real release, so both halves now move together. Dependabot did not raise download-artifact separately because open-pull-requests-limit: 5 was already saturated by the other actions updates, so the pair arrived split. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
|
Pushed 8c02e96 to this branch to move
The workflow's dry run cannot catch a mismatch there, because the Same-generation v4+ artifacts are mutually compatible — the hard incompatibility was v3→v4, which changed the storage backend — so the split was unlikely to break anything. But "unlikely" is a poor standard for a path only exercised while publishing. Both halves now move together: upload Worth noting why the pair arrived split: Dependabot never raised Dry run on this branch passed the build job (including the |
The 3.0.1rc1 tag failed to publish: `no matches found for application/xchtmlreport-*`. `actions/download-artifact` with no `name` created a directory per artifact under v4, which is where the `application/` prefix came from, and 3.0.0 shipped that way. Under v8 it extracts straight into the workspace instead, so the archive has been landing one directory up since #404 bumped the version. Both versions log "An extra directory with the artifact name will be created"; only v4 does it. Nothing caught this at the time because the release action it was feeding defaults `fail_on_unmatched_files` to false. The next release would have published a signed, notarized build with no binary attached to it and gone green. It only surfaced now because the gh CLI step that replaced it in #427 fails on an unmatched pattern. Naming the artifact and its destination pins the layout instead of inheriting whatever the current major version does with it.
1 participant
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)