[tunc-d]

Merge and publication gates

Draft / blocked: do not merge this release PR until #2498 is merged into main. Do not publish from this branch: it intentionally does not contain the retry implementation.

After #2498 and this metadata PR are merged, recheck the version against npm and run the repository release workflow's build, tests and packaging validation on the merged main before any separately authorized publication. No merge, auto-merge or publication is requested by this PR.

Summary

Prepare the intended @actions/artifact 6.3.0 release, separately from the retry implementation, following the package-specific release shape in #2500.

Only three files change:

• packages/artifact/package.json: version 6.2.2 -> 6.3.0.
• packages/artifact/package-lock.json: only the top-level and root-package version fields, generated by npm version 6.3.0 --no-git-tag-version --ignore-scripts; dependency resolutions are unchanged.
• packages/artifact/RELEASES.md: retry-only notes for [3/4] artifact: honor Retry-After on 429 #2498, describing positive integer Retry-After seconds on HTTP 429, the 120-second accumulated-retry-sleep cap (not an HTTP wall-clock timeout), and the fallback base interval increase from 3 to 8 seconds. The 1.5 multiplier and maximum of 5 attempts are retained; there is no guarantee of crossing a minute boundary on an individual retry.

At preparation time, upstream main is dc752c75f8868e7e83761116161c952938b8ddae with artifact version 6.2.2; npm's latest artifact is 6.2.1 and 6.3.0 is not published. #2498 is open at 4449111a58521b9b60acc34e693ae8a69b4efbe6 and contains only the retry source and tests. These notes describe the intended release after that prerequisite lands, not changes already present on main.

Separate dependency work

#2515 prepares @actions/http-client 4.0.2 as a separate draft; that version is not published. The standalone audit/dependency work in #2517 is also a separate, unmerged draft. Neither is included or claimed fixed by this PR. No dependency ranges, resolutions or overrides are added here. If dependency fixes are later included in the artifact release, they must first land on main; any new package version must be published before it is consumed, and the release metadata/lock/notes must then be reviewed against those actual changes.

Validation

• Exact three-file scope, manifest/lock version agreement, unchanged dependency graph and existing release notes, and git diff --check verified.
• Lockfile JSON and new release-entry Markdown formatting checks pass. The manifest's full-file Prettier warning is also present on main; existing formatting is preserved byte-for-byte except for the version.
• npm pack --dry-run --json --ignore-scripts confirms @actions/artifact@6.3.0 metadata. This is a metadata-only preview: compiled lib was not built in this slice and it is not a validated release payload.
• Retry source/tests are not duplicated or modified; full merged-source build/tests and release packaging remain a publication gate.

[tunc-d]

Superseded by #2498: artifact 6.3.0 version metadata and release notes have been restored there alongside the retry implementation. Closing this redundant draft without merging; its branch and commits are retained.