From cccb8f1b52c09783e10899f5269261fba7c8853f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 16 Aug 2026 20:23:43 +0000 Subject: [PATCH 1/2] chore(deps): bump the workflow-actions group with 3 updates Bumps the workflow-actions group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [step-security/harden-runner](https://github.com/step-security/harden-runner) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...b09bb98e06d4d774595224525879c09bc6e98c40) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4.3.0...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: workflow-actions - dependency-name: step-security/harden-runner dependency-version: 2.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: workflow-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: workflow-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/hourly-product-development.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f9304c32..c042736a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -108,7 +108,7 @@ jobs: PY ) - name: Upload package-acceptance evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: package-acceptance-${{ env.CI_SOURCE_SHA }} path: dist/ diff --git a/.github/workflows/hourly-product-development.yml b/.github/workflows/hourly-product-development.yml index 22a4d8a4..187df81d 100644 --- a/.github/workflows/hourly-product-development.yml +++ b/.github/workflows/hourly-product-development.yml @@ -29,7 +29,7 @@ jobs: changed: ${{ steps.package.outputs.changed }} steps: - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 with: egress-policy: block allowed-endpoints: > @@ -244,7 +244,7 @@ jobs: VERIFIER_BASE_IMAGE: "python@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91" steps: - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 with: egress-policy: audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4cc8c805..b172c9d4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -124,14 +124,14 @@ jobs: sha256sum --check --strict ../dist/SHA256SUMS ) - name: Upload complete checksummed release evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-evidence-${{ github.sha }} path: dist/ if-no-files-found: error retention-days: 14 - name: Upload canonical PyPI distributions - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: pypi-distributions-${{ github.sha }} path: publish-dist/ @@ -530,7 +530,7 @@ jobs: id-token: write steps: - name: Download canonical reviewed distributions - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: pypi-distributions-${{ github.sha }} path: dist @@ -556,7 +556,7 @@ jobs: contents: write steps: - name: Download complete reviewed release evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: release-evidence-${{ github.sha }} path: release-evidence From 0011c0c08b7403f76c5853fd855e4035e715ecfd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 05:16:02 -0700 Subject: [PATCH 2/2] test(ci): align artifact action contract pins --- tests/test_release_contracts.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_release_contracts.py b/tests/test_release_contracts.py index 6f11ca59..09f4a24c 100644 --- a/tests/test_release_contracts.py +++ b/tests/test_release_contracts.py @@ -29,10 +29,10 @@ "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33" ) UPLOAD_ARTIFACT_ACTION = ( - "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" + "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" ) DOWNLOAD_ARTIFACT_ACTION = ( - "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093" + "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" )