From e767028ef10ddf67fecd532230442d916203f82b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 23 Aug 2026 15:43:59 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0c2131f..068b599 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,7 +47,7 @@ jobs: - run: npm run check:links - name: Upload tested npm package if: matrix.node-version == '24.x' - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0, Node.js 24 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0, Node.js 24 with: name: npm-package path: artifacts/*.tgz @@ -77,7 +77,7 @@ jobs: - name: Verify package version matches release tag run: test "v$(node -p "require('./package.json').version")" = "$GITHUB_REF_NAME" - name: Download tested npm package - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0, Node.js 24 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v7.0.0, Node.js 24 with: name: npm-package path: artifacts From 09ddda01f725932a9d3c041ac44573664c4cbb22 Mon Sep 17 00:00:00 2001 From: CodeSigils Date: Mon, 31 Aug 2026 11:41:45 +0300 Subject: [PATCH 2/2] ci: sync artifact action SHA guards and version comments for v7/v8 bump --- .github/workflows/ci.yml | 4 ++-- test/unit/docs.test.js | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 068b599..76c6649 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,7 +47,7 @@ jobs: - run: npm run check:links - name: Upload tested npm package if: matrix.node-version == '24.x' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0, Node.js 24 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1, Node.js 24 with: name: npm-package path: artifacts/*.tgz @@ -77,7 +77,7 @@ jobs: - name: Verify package version matches release tag run: test "v$(node -p "require('./package.json').version")" = "$GITHUB_REF_NAME" - name: Download tested npm package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v7.0.0, Node.js 24 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1, Node.js 24 with: name: npm-package path: artifacts diff --git a/test/unit/docs.test.js b/test/unit/docs.test.js index 13078c7..c5e2ed8 100644 --- a/test/unit/docs.test.js +++ b/test/unit/docs.test.js @@ -53,8 +53,8 @@ it('keeps CI and release safety guarantees documented and wired', () => { assert.match(workflow, /actions\/download-artifact@/); assert.match(workflow, /npm publish \.\/artifacts\/\*\.tgz/); assert.match(workflow, /matrix:/); - assert.match(workflow, /upload-artifact@b7c566a/); - assert.match(workflow, /download-artifact@37930b1/); + assert.match(workflow, /upload-artifact@043fb46d/); + assert.match(workflow, /download-artifact@3e5f45b2/); assert.match(release, /DRY_RUN=1/); assert.match(release, /--generate-notes/); assert.match(releaseNotes, /categories:/);