Repository navigation
chore(ci): bump actions/download-artifact from 5 to 8 - #1005
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area: packaging-ci
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v5...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/download-artifact-8
branch
from
October 18, 2026 09:58
60565a7 to
3f73a17
Compare
1 task done
cemililik
added a commit
that referenced
this pull request
Oct 18, 2026
…oy-pages 5 and pypi-publish 1.14.2 (#1015) ## Summary Five Dependabot GitHub Actions bumps (#1002, #1004, #1005, #1006, #1009) combined into one pull request so they cost one CI round instead of five (each merge makes the others "behind", and branch protection requires an up-to-date branch). Dependabot closes its own pull requests when the same change lands. The individual commits are merged unchanged. ## Review | Action | Change | Checked | |---|---|---| | `pypa/gh-action-pypi-publish` | `1.14.0` → `1.14.2` (SHA pin) | The new pin `dc37677b…` is the commit of tag `v1.14.2` (dereferenced the annotated tag; the old pin is `v1.14.0`'s). The release only updates the action's own dependency tree (Twine 7, pypi-attestations, sigstore): `action.yml` and `requirements/` change, nothing else | | `actions/checkout` | `v5` → `v7` | v6 stores credentials in a separate file; v7 blocks checking out fork PRs under `pull_request_target`/`workflow_run`. This repository uses neither trigger and no workflow pushes with the persisted credentials | | `actions/setup-python` | `v6` → `v7` | ESM migration, and the `pip-install` input is removed; no workflow passes it (`cache: pip` is unaffected) | | `actions/download-artifact` | `v5` → `v8` | Hash mismatches now fail by default and non-zip artifacts are no longer unzipped; our `dist` artifact is a zip uploaded by `upload-artifact@v5`, which `v8` reads | | `actions/deploy-pages` | `v4` → `v5` | Node 24 runtime and polling back-off only | ### Also in this pull request Every `actions/checkout` step now sets `persist-credentials: false` (11 steps in 5 workflows). CodeRabbit flagged it on the bumped lines; the default stores the workflow token in the git configuration of jobs that then run checked-out code, and no job pushes or fetches with it (the assign-on-comment workflow already did this). ### What CI proves, and what it does not This pull request's own CI exercises `checkout` and `setup-python` (`ci.yml`). The other three live in `publish.yml` and `site-deploy.yml`, which run only on a release tag or a push to `main`, so **they are untested until the next release**. All three fail closed: a broken download or deploy step stops before anything reaches PyPI or the site. If you want certainty first, merge everything except `download-artifact` and `pypi-publish` and try them on a release candidate tag. ## Type - [x] CI / dependency ## Testing - CI (lint, validate, tests on Python 3.10–3.13) on this branch; all workflow files parse; `check_ci_failure_masking` and the guard-wiring tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Modernize the repository’s GitHub Actions and harden checkout credential handling across automated workflows. Enhancements: - Upgrade GitHub Actions used across CI, publishing, and deployment workflows to their current major versions. - Disable persisted checkout credentials across workflow jobs to reduce unnecessary token exposure. CI: - Update artifact download, PyPI publishing, and Pages deployment actions to newer releases. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
Author
|
Looks like actions/download-artifact is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/download-artifact-8
branch
October 18, 2026 11:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/download-artifact from 5 to 8.
Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
9000827Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2e455989Prepare download-artifact v8.0.2a00b90cMerge pull request #492 from actions/tunc-d-download-artifact-package-bump29bb7ceUpdate@actions/artifactto 6.3.1484a0b5Update the readme (#473)3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issues